Overview

overview

8

Static

static

3

8d76e45cc9...f8.exe

windows10-2004-x64

8

8d76e45cc9...f8.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 21:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8d76e45cc98e7838c89066f71960b1b3506580fda7e79c8e2a009860dcb427f8.exe
  • Size 12.3MB
  • Sample260822-1gzfvsvsfs
  • SHA256 8d76e45cc98e7838c89066f71960b1b3506580fda7e79c8e2a009860dcb427f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Blocks application from running via registry modification 1 IoCs

    Adds application to list of disallowed applications.

    defense_evasion
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 1 IoCs
    defense_evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 20 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d76e45cc98e7838c89066f71960b1b3506580fda7e79c8e2a009860dcb427f8.exe
    "C:\Users\Admin\AppData\Local\Temp\8d76e45cc98e7838c89066f71960b1b3506580fda7e79c8e2a009860dcb427f8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "IDMan.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3308
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build10f.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build10f.exe" /skipdlgs
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\" -skdlgs
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2516
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4848
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:2588
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4376
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4300
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4136
        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:572
        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr /onsilentsetup
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:6124
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4764
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:2272
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4212
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:1556
    • C:\Windows\SysWOW64\timeout.exe
      "C:\Windows\System32\timeout.exe" /t 3
      2⤵
      • System Location Discovery: System Language Discovery
      • Delays execution with timeout.exe
      PID:1160
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "IDMan.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1944
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.6.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.6.exe" -silent
      2⤵
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:2472
      • C:\Windows\SysWOW64\reg.exe
        reg.exe import C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:3760
        • C:\Windows\system32\reg.exe
          reg query "HKCU\Console" /v ForceV2
          4⤵
            PID:3736
          • C:\Windows\system32\find.exe
            find /i "0x0"
            4⤵
              PID:5072
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:900
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3900
              • C:\Windows\system32\cmd.exe
                cmd
                5⤵
                  PID:5656
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat" "
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4832
              • C:\Windows\system32\find.exe
                find /i "C:\Users\Admin\AppData\Local\Temp"
                4⤵
                  PID:3324
                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':PowerShellTest:\s*';iex ($f[1])"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3136
                • C:\Windows\system32\find.exe
                  find /i "FullLanguage"
                  4⤵
                    PID:2456
                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2428
                  • C:\Windows\system32\find.exe
                    find /i "computersystem"
                    4⤵
                      PID:3628
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul
                      4⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5368
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5972
                    • C:\Windows\system32\reg.exe
                      reg query HKU\\Software
                      4⤵
                        PID:1508
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul
                        4⤵
                        • Executes a command shell one-liner
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5532
                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"
                          5⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3432
                      • C:\Windows\system32\reg.exe
                        reg query HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\Software
                        4⤵
                          PID:4892
                        • C:\Windows\system32\reg.exe
                          reg delete HKCU\IAS_TEST /f
                          4⤵
                          • Modifies registry key
                          PID:2588
                        • C:\Windows\system32\reg.exe
                          reg delete HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\IAS_TEST /f
                          4⤵
                            PID:4812
                          • C:\Windows\system32\reg.exe
                            reg add HKCU\IAS_TEST
                            4⤵
                            • Modifies registry key
                            PID:2640
                          • C:\Windows\system32\reg.exe
                            reg query HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\IAS_TEST
                            4⤵
                              PID:4376
                            • C:\Windows\system32\reg.exe
                              reg delete HKCU\IAS_TEST /f
                              4⤵
                              • Modifies registry key
                              PID:4492
                            • C:\Windows\system32\reg.exe
                              reg delete HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\IAS_TEST /f
                              4⤵
                                PID:2184
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
                                4⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4136
                                • C:\Windows\system32\reg.exe
                                  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
                                  5⤵
                                    PID:2504
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\DownloadManager" /v ExePath 2>nul
                                  4⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5300
                                  • C:\Windows\system32\reg.exe
                                    reg query "HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\DownloadManager" /v ExePath
                                    5⤵
                                      PID:2264
                                  • C:\Windows\system32\reg.exe
                                    reg add HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
                                    4⤵
                                      PID:3656
                                    • C:\Windows\system32\reg.exe
                                      reg query HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
                                      4⤵
                                        PID:3260
                                      • C:\Windows\system32\reg.exe
                                        reg delete HKU\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f
                                        4⤵
                                          PID:3184
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"
                                          4⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5876
                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"
                                            5⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4952
                                        • C:\Windows\system32\reg.exe
                                          reg export HKCU\Software\Classes\Wow6432Node\CLSID "C:\Windows\Temp\_Backup_HKCU_CLSID_20260822-223816873.reg"
                                          4⤵
                                            PID:3484
                                          • C:\Windows\system32\reg.exe
                                            reg query "HKCU\Software\DownloadManager" "/v" "Email"
                                            4⤵
                                              PID:8
                                            • C:\Windows\system32\reg.exe
                                              reg query "HKCU\Software\DownloadManager" "/v" "Serial"
                                              4⤵
                                                PID:588
                                              • C:\Windows\system32\reg.exe
                                                reg query "HKCU\Software\DownloadManager" "/v" "scansk"
                                                4⤵
                                                  PID:3636
                                                • C:\Windows\system32\reg.exe
                                                  reg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"
                                                  4⤵
                                                    PID:3904
                                                  • C:\Windows\system32\reg.exe
                                                    reg query "HKCU\Software\DownloadManager" "/v" "radxcnt"
                                                    4⤵
                                                      PID:2452
                                                    • C:\Windows\system32\reg.exe
                                                      reg query "HKCU\Software\DownloadManager" "/v" "LstCheck"
                                                      4⤵
                                                        PID:2656
                                                      • C:\Windows\system32\reg.exe
                                                        reg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"
                                                        4⤵
                                                          PID:1128
                                                        • C:\Windows\system32\reg.exe
                                                          reg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"
                                                          4⤵
                                                            PID:3020
                                                          • C:\Windows\system32\reg.exe
                                                            reg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"
                                                            4⤵
                                                              PID:2232
                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell.exe "$sid = 'S-1-5-21-4046655672-1449839301-2197395821-1000'; $HKCUsync = 1; $lockKey = $null; $deleteKey = 1; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':regscan\:.*';iex ($f[1])"
                                                              4⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1184
                                                            • C:\Windows\system32\chcp.com
                                                              chcp 65001
                                                              4⤵
                                                                PID:4660
                                                              • C:\Windows\system32\reg.exe
                                                                REG ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f
                                                                4⤵
                                                                  PID:1548
                                                                • C:\Windows\system32\reg.exe
                                                                  REG ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f
                                                                  4⤵
                                                                    PID:5116
                                                                  • C:\Windows\system32\reg.exe
                                                                    REG ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f
                                                                    4⤵
                                                                      PID:5636
                                                                    • C:\Windows\system32\reg.exe
                                                                      REG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " " /f
                                                                      4⤵
                                                                        PID:1944
                                                                      • C:\Windows\system32\reg.exe
                                                                        REG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "Admin" /f
                                                                        4⤵
                                                                          PID:5800
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
                                                                        3⤵
                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5076
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "TipStartUp" /t REG_DWORD /d "1" /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5996
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "FName" /t REG_SZ /d "CyberMania" /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2836
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "LName" /t REG_SZ /d " " /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2116
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cybermania.ws/
                                                                      2⤵
                                                                      • Drops file in Windows directory
                                                                      • Checks SCSI registry key(s)
                                                                      • Enumerates system info in registry
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:5148
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ff90f17c188,0x7ff90f17c194,0x7ff90f17c1a0
                                                                        3⤵
                                                                          PID:4540
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7844695093270433191,1083829149868052940,262144 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
                                                                          3⤵
                                                                            PID:5784
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,16619915290153949166,1264006134266891320,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
                                                                            3⤵
                                                                            • System Time Discovery
                                                                            PID:2848
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,9823824275287990698,13137985214508508613,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:13
                                                                            3⤵
                                                                              PID:2488
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,14511621296363088127,8865762472758297469,2097152 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
                                                                              3⤵
                                                                                PID:832
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,15027815451975823241,6955615410123815621,2097152 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
                                                                                3⤵
                                                                                  PID:2596
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,17385143636336458928,7744563682235103682,2097152 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
                                                                                  3⤵
                                                                                    PID:4344
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,9304730160456512758,13700355699501929157,2097152 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
                                                                                    3⤵
                                                                                      PID:4204
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,13191180087790095664,4441364055451167254,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
                                                                                      3⤵
                                                                                        PID:3252
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,14676142632287529086,15076995944980062825,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
                                                                                        3⤵
                                                                                          PID:1108
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,1419369650888794791,10629417331194745866,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
                                                                                          3⤵
                                                                                            PID:2264
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5800,i,1304120301190046428,18134280308920082221,2097152 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
                                                                                            3⤵
                                                                                              PID:4952
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,7110781921985727690,12991672828859994674,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
                                                                                              3⤵
                                                                                                PID:2820
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,9904426855393737219,6825978026350754820,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:4700
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,9904426855393737219,6825978026350754820,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
                                                                                                  3⤵
                                                                                                    PID:1780
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5584,i,15691721608422218504,11492636934366350477,2097152 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
                                                                                                    3⤵
                                                                                                      PID:2744
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,12477644416373099254,296239035967847243,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
                                                                                                      3⤵
                                                                                                        PID:4364
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3614605339867670283,2652209513876390365,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
                                                                                                        3⤵
                                                                                                          PID:8
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,12269044767614712784,609516389150214710,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
                                                                                                          3⤵
                                                                                                            PID:3636
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,10495523503541771968,9529304017406502391,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
                                                                                                            3⤵
                                                                                                              PID:4588
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,12619626460067144133,6071099534033804984,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
                                                                                                              3⤵
                                                                                                                PID:1536
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,5544258150964096192,2875155018629317675,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
                                                                                                                3⤵
                                                                                                                  PID:6040
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,14998824333314977773,8927380673412843327,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
                                                                                                                  3⤵
                                                                                                                    PID:3332
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,15345660351777457492,4772953693614132081,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
                                                                                                                    3⤵
                                                                                                                      PID:2936
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,9878220271305811454,2307010801638492511,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
                                                                                                                      3⤵
                                                                                                                        PID:4864
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,5575242699437578010,13466968559085227152,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
                                                                                                                        3⤵
                                                                                                                          PID:4728
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,9948040133283596499,6302640614398962151,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:14
                                                                                                                          3⤵
                                                                                                                            PID:3844
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,1319441815407951494,6256585588395243933,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
                                                                                                                            3⤵
                                                                                                                              PID:5900
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,10705635825065255108,6377350253246277059,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
                                                                                                                              3⤵
                                                                                                                                PID:1108
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5652,i,11150366345306343313,13722902202547243918,262144 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:10
                                                                                                                                3⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:4124
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,6092986154812539492,10690320124687346668,524288 --field-trial-handle=2288,i,6403665893998091770,2699771875140217801,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:14
                                                                                                                                3⤵
                                                                                                                                  PID:5740
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                              1⤵
                                                                                                                                PID:4452
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                1⤵
                                                                                                                                  PID:2548
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                  1⤵
                                                                                                                                    PID:2368

                                                                                                                                  Network

                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                        Reconnaissance

                                                                                                                                        Resource Development

                                                                                                                                        Initial Access

                                                                                                                                        Execution

                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                        3
                                                                                                                                        T1059

                                                                                                                                        PowerShell

                                                                                                                                        1
                                                                                                                                        T1059.001

                                                                                                                                        Visual Basic

                                                                                                                                        1
                                                                                                                                        T1059.005

                                                                                                                                        Windows Command Shell

                                                                                                                                        1
                                                                                                                                        T1059.003

                                                                                                                                        Persistence

                                                                                                                                        Browser Extensions

                                                                                                                                        1
                                                                                                                                        T1176

                                                                                                                                        Event Triggered Execution

                                                                                                                                        1
                                                                                                                                        T1546

                                                                                                                                        Component Object Model Hijacking

                                                                                                                                        1
                                                                                                                                        T1546.015

                                                                                                                                        Privilege Escalation

                                                                                                                                        Event Triggered Execution

                                                                                                                                        1
                                                                                                                                        T1546

                                                                                                                                        Component Object Model Hijacking

                                                                                                                                        1
                                                                                                                                        T1546.015

                                                                                                                                        Defense Evasion

                                                                                                                                        Modify Registry

                                                                                                                                        3
                                                                                                                                        T1112

                                                                                                                                        Credential Access

                                                                                                                                        Credentials from Password Stores

                                                                                                                                        1
                                                                                                                                        T1555

                                                                                                                                        Credentials from Web Browsers

                                                                                                                                        1
                                                                                                                                        T1555.003

                                                                                                                                        Unsecured Credentials

                                                                                                                                        1
                                                                                                                                        T1552

                                                                                                                                        Credentials In Files

                                                                                                                                        1
                                                                                                                                        T1552.001

                                                                                                                                        Discovery

                                                                                                                                        Browser Information Discovery

                                                                                                                                        1
                                                                                                                                        T1217

                                                                                                                                        Peripheral Device Discovery

                                                                                                                                        1
                                                                                                                                        T1120

                                                                                                                                        Query Registry

                                                                                                                                        3
                                                                                                                                        T1012

                                                                                                                                        System Information Discovery

                                                                                                                                        3
                                                                                                                                        T1082

                                                                                                                                        System Location Discovery

                                                                                                                                        1
                                                                                                                                        T1614

                                                                                                                                        System Language Discovery

                                                                                                                                        1
                                                                                                                                        T1614.001

                                                                                                                                        System Time Discovery

                                                                                                                                        1
                                                                                                                                        T1124

                                                                                                                                        Lateral Movement

                                                                                                                                        Collection

                                                                                                                                        Data from Local System

                                                                                                                                        1
                                                                                                                                        T1005

                                                                                                                                        Command and Control

                                                                                                                                        Exfiltration

                                                                                                                                        Impact

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        IDMGetAll.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                                                                                                                                        • Size 73KB
                                                                                                                                        • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDMGetAll64.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                                                                                                                                        • Size 93KB
                                                                                                                                        • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDMIECC.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                                                                                                                                        • Size 463KB
                                                                                                                                        • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDMIECC64.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                                                                                                                                        • Size 656KB
                                                                                                                                        • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDMNetMon64.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                                                                                                                                        • Size 564KB
                                                                                                                                        • SHA256 9840d78e94f9df6b03be2246b9814263a5ddf287489cd260a25a4d51e4a1bc5b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDMShellExt64.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                                                                                                                                        • Size 36KB
                                                                                                                                        • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDMan.exe
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                                                                                                                                        • Size 5.9MB
                                                                                                                                        • SHA256 6c047f105fc04fb6a05d72a652f3dbdd3cf65f9be22bd4f71489fd39e0254ef5
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        downlWithIDM.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                                                                                                                                        • Size 197KB
                                                                                                                                        • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        downlWithIDM64.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                                                                                                                                        • Size 155KB
                                                                                                                                        • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        idmBroker.exe
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                                                                                                                                        • Size 153KB
                                                                                                                                        • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        idmfsa.dll
                                                                                                                                        • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                                                                                                                                        • Size 90KB
                                                                                                                                        • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        blocklist
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                        • Size 105KB
                                                                                                                                        • SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        settings.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        • Size 280B
                                                                                                                                        • SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        settings.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        • Size 280B
                                                                                                                                        • SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        7f91e82b-2123-4c88-8d7c-1f13ad0e2168.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f91e82b-2123-4c88-8d7c-1f13ad0e2168.tmp
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 7e4094bf5baae832f931602a96bba89b2feaabdf43a27deed07ecd9e460a258e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                        • Size 6B
                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 0a7ebf331a19155fa59909f90173c0326b3d64cb2be16024080f59e2132df2bc
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        SiteList-Enterprise.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                        • Size 2B
                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        Edge Profile.ico
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                        • Size 70KB
                                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 9595e3035c90a3e12f226323294715ff88512ec25a47d8c6e0c2cbe4cdb7f600
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                        • Size 2B
                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        Sdch Dictionaries
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                        • Size 40B
                                                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 16KB
                                                                                                                                        • SHA256 da1be8373c546db51b1552159fbfb6dae4d497a233fa22273db311af5d63c9da
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 941f07ca906f6624a1522b6483747e563b7e7cbccb25ae71b3b897b0c207c4df
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Secure Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                        • Size 35KB
                                                                                                                                        • SHA256 a2df53b7f64120566ebfddf4b9c3c978d1db51ec55f0b964e7830ac2a3c26bd1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        sync_diagnostic.log
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 703581d0c7cf2b255e7e30bcb2c032031c91498a78d15258b0c639a6aa1b7c9b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        OperationConfig
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                        • Size 22KB
                                                                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        OperationConfig~RFe5aab83.TMP
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aab83.TMP
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 38KB
                                                                                                                                        • SHA256 ea3b148331a1b5d0c568c8bc8f352f921e0f1803a239c9c240e69db1e5229ac5
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 34KB
                                                                                                                                        • SHA256 7f6654be8bf668864202f976f2ff28674d171310a3a9d7f1db96de41583299d0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 42KB
                                                                                                                                        • SHA256 13660c4a61913c1e508999bc306615f4bea822075460024632dcf7ff65e8ce3e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 34KB
                                                                                                                                        • SHA256 ce38c4451891dd27dd8e13b4c85d4f23ac2fda7f6b56771eb399de03dfff0b60
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 39KB
                                                                                                                                        • SHA256 24af8ccb7a260b6427ac90a76c6cba4e86e1b701364453ab10cf1a6d9ad7dc63
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        metadata.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                        • Size 372B
                                                                                                                                        • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        metadata.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                        • Size 132B
                                                                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        metadata.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                        • Size 492B
                                                                                                                                        • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        metadata.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                        • Size 252B
                                                                                                                                        • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                        • Size 154KB
                                                                                                                                        • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        metadata.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                        • Size 13B
                                                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        metadata.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                        • Size 132B
                                                                                                                                        • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 7a8ef3e2be3c4c43ee8abb7ae0a5730621310896948c75ad8ccf88881aee2350
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 aef8b020212d19e8c6e52e5f91f96126439e9399bc7e0a9ef369ab991df7b2fa
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 68485f62e262858267abba7c93ba9219b2d843592b2c28edf15036ef8218d87d
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 61fa021e6fb9bf6e62c66160ca7f4e57206d1371e9779346630293e15afec314
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        83986d32-432d-487f-a276-7b95298af270.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\83986d32-432d-487f-a276-7b95298af270.tmp
                                                                                                                                        • Size 1B
                                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        BATCLEN.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat
                                                                                                                                        • Size 19KB
                                                                                                                                        • SHA256 12b47c1949cc555c2f68f9fd4677ed5266f25c4da4630bec36e303629b133225
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDMRegClean.reg
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg
                                                                                                                                        • Size 5KB
                                                                                                                                        • SHA256 4c0e2396b9fca1bbeb36e9ebb27f27e63cd2662abf8b18f042d872322e1363eb
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDM1.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                                                                                                                                        • Size 163KB
                                                                                                                                        • SHA256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDMSetup2.log
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        CyberMania.url
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.url
                                                                                                                                        • Size 77B
                                                                                                                                        • SHA256 ae6a476ce9024230ccaf426ba9f0f6f3dbe6a54547fd317f5e014dacd1671121
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        IDM_6.4x_Crack_v20.6.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.6.exe
                                                                                                                                        • Size 66KB
                                                                                                                                        • SHA256 bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        idman643build10f.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build10f.exe
                                                                                                                                        • Size 12.0MB
                                                                                                                                        • SHA256 964716f594349c1683bcdb5962f699d6d5443d1df0e726ec97727c480e671760
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        WININF.vbs
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WININF.vbs
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 14f12199c930e4d4d6671dd9565423aac5ae259668c64298e194f329895d670a
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        __PSScriptPolicyTest_iwf4ljm3.ubu.ps1
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iwf4ljm3.ubu.ps1
                                                                                                                                        • Size 60B
                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        content_new.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_1896663550\CRX_INSTALL\content_new.js
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        content.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_2018849263\CRX_INSTALL\content.js
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 0a9b427f9c1bd844f73c1768b60fdf30bccbef5ce9299a27f4fe11e13348b66d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Internet Download Manager.lnk
                                                                                                                                        • Path C:\Users\Admin\Desktop\Internet Download Manager.lnk
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 b7e055445a5a4f45f2677ff1ce67b8b0e54d0c763b497e34d9bdef127ad32e32
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        memory/552-508-0x0000000000400000-0x0000000000442000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/552-544-0x0000000000400000-0x0000000000442000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2516-464-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2516-15-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3136-519-0x000001FEDC800000-0x000001FEDC822000-memory.dmp
                                                                                                                                        Download