Analysis
- geolocation tags
- user interaction
yes - max time kernel
354s - max time network
349s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 22:20
General
- Target https://s1-filecr.xyz/457a3aee6c17db82?ref=9a6e94714964eb1995fb79a055f9e5d6
- Sample261024-19acfaev7n
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 17 IoCs
Network request originating from process or tool commonly abused by malware.
- Blocks application from running via registry modification 2 IoCs
Adds application to list of disallowed applications.
- Disables RegEdit via registry modification 2 IoCs
- Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 2 IoCs
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 4 IoCs
- Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 31 IoCs
- Loads dropped DLL 61 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in System32 directory 16 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 29 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 12 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 23 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 58 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 35 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 3 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 57 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 24 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 38 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://s1-filecr.xyz/457a3aee6c17db82?ref=9a6e94714964eb1995fb79a055f9e5d61⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa21d9c728,0x7ffa21d9c734,0x7ffa21d9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,11864125087254453803,9369609792301551225,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,15575633299872556636,10754749833038782070,262144 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2136 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,13806306527164255934,13610359236062140421,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1788 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2940,i,12213317553661565341,16134211058980072719,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2936,i,4349958632408149144,11445516202970224841,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,18343182681036486044,952994928320418826,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4288 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,14624318358804260168,16645262754138981009,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,6432564004774705178,14889739368959452275,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5332 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5416,i,2265230418893656837,5049776290592211647,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5632,i,5882437115254879401,7403506805762519812,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3392,i,12493311477080738220,2285151500420087205,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5464,i,16249302179642135587,8882488439955485971,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5476,i,3708442025557619822,17723586241573148432,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4796 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5900,i,11893427627563390644,11535396724815811459,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3196,i,1238183162886319243,15063439741323854277,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6040 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,2363422898166952006,13214170387301978039,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6120 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,17622606325651460843,9536851489923970034,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5920 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4248,i,17547544497083552316,3724809518568623896,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,8182357072447072085,6943281160057507072,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6024 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,15823921599055428425,1988989069409386957,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=956 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,6524071899843191823,9890385523812673058,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6248 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,185814394971696631,9146972524585581724,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6412 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6480,i,10821240719883180858,4163521762334227750,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6464 /prefetch:22⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.9246cbba9b1b1009 > \\.\pipe\chrome.nativeMessaging.out.9246cbba9b1b10092⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.7f151d7e81dec025 > \\.\pipe\chrome.nativeMessaging.out.7f151d7e81dec0252⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.8105fc80227b45ea > \\.\pipe\chrome.nativeMessaging.out.8105fc80227b45ea2⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.b73d42ea14860ad9 > \\.\pipe\chrome.nativeMessaging.out.b73d42ea14860ad92⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6324,i,18084569031793968389,14268764998514911276,262144 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.4549ed8eca4898ac > \\.\pipe\chrome.nativeMessaging.out.4549ed8eca4898ac2⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6308,i,16354116628352731096,14074966866157278049,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5864,i,15278787882220244064,9730953351152608124,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5672,i,10381723500119808044,14371992516577458752,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6776,i,17518946026249743216,515709231593945040,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6860,i,793611171480484084,5147044232630646441,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6912 /prefetch:12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.b2573976c400a57d > \\.\pipe\chrome.nativeMessaging.out.b2573976c400a57d2⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,5221066464128191684,16506051722393503285,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5616 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3084,i,4670056499375410971,13520342884054551096,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4828 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6724,i,790811654204855786,4762327135479179606,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6900,i,12749069476920762233,1398994375148751836,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7044 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,11095220359213359691,8398348813999544516,524288 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7032 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7068,i,1675992377403732501,10290660518829162623,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7472,i,2147420239408074680,15789215287590064645,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7584,i,13062619441072718379,12328912768000867207,2097152 --field-trial-handle=2140,i,16150096246799458586,11505156761985692409,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7568 /prefetch:12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.a6f526b9657fbbf9 > \\.\pipe\chrome.nativeMessaging.out.a6f526b9657fbbf92⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.1574b32f2b923c6d > \\.\pipe\chrome.nativeMessaging.out.1574b32f2b923c6d2⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=03⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23635:202:7zEvent34621⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\idman643build16.exe"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\idman643build16.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html5⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2052 -prefsLen 27099 -prefMapHandle 2056 -prefMapSize 270279 -ipcHandle 2128 -initialChannelId {07f9281d-4747-435d-978f-c1964bff835b} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2524 -prefsLen 27135 -prefMapHandle 2528 -prefMapSize 270279 -ipcHandle 2544 -initialChannelId {e3229312-aaf8-42c4-ab26-7ffeb727928c} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 25164 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {bd2e60ac-c9be-4490-8241-24bbb85c527a} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27276 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {75161e72-f22d-401c-bd22-3e83ad7b73c1} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3124 -prefsLen 25213 -prefMapHandle 3044 -prefMapSize 270279 -jsInitHandle 3052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2980 -initialChannelId {7bf0cbe0-fbc7-4b83-8723-049a1bd76078} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4512 -prefsLen 25213 -prefMapHandle 4516 -prefMapSize 270279 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3288 -initialChannelId {2ca274c7-64bc-4da4-90ad-5831aa668ff5} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3196 -prefsLen 25213 -prefMapHandle 3200 -prefMapSize 270279 -jsInitHandle 2988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4624 -initialChannelId {66a66ff4-4f4d-406e-8157-712b68bc8db9} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5016 -prefsLen 34824 -prefMapHandle 4952 -prefMapSize 270279 -jsInitHandle 4956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4980 -initialChannelId {3c3a7582-fc4c-4073-b044-51f4a3f1c6c9} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5500 -prefsLen 35012 -prefMapHandle 5504 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {ddff14de-10e0-4925-b9be-359e3416246b} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 32952 -prefMapHandle 4716 -prefMapSize 270279 -jsInitHandle 3148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {67e5da63-ff3f-4bc7-9d42-89c65f99f7bb} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab6⤵
- Checks processor information in registry
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf5⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\Read me first.txt1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\" -an -ai#7zMap19980:226:7zEvent98971⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0d34e55d-a9fb-654e-93a0-dcdcbdbfccb6}\idmwfp.inf" "9" "4fc2928b3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Internet Download Manager"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000158" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000164" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000158" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000160" "WinSta0\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\IDM_6.4x_Crack_v20.7\IDM_6.4x_Crack_v20.7.exe"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\IDM_6.4x_Crack_v20.7\IDM_6.4x_Crack_v20.7.exe"1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\IDM_UPDT_69wrlv0.vbs" "https://www.internetdownloadmanager.com/idm.xml" "Program_Version" "Primary_Download_URL" "6.43.16.2" "IDM" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_158aws9.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.7" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\reg.exereg.exe import C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg2⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E | cmd3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "4⤵
-
-
C:\Windows\system32\cmd.execmd4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat" "3⤵
-
-
C:\Windows\system32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':PowerShellTest:\s*';iex ($f[1])"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\find.exefind /i "FullLanguage"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\find.exefind /i "computersystem"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg query HKU\\Software3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-2101206053-1414382737-268919432-1000\Software3⤵
-
-
C:\Windows\system32\reg.exereg delete HKCU\IAS_TEST /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-2101206053-1414382737-268919432-1000\IAS_TEST /f3⤵
-
-
C:\Windows\system32\reg.exereg add HKCU\IAS_TEST3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-2101206053-1414382737-268919432-1000\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg delete HKCU\IAS_TEST /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-2101206053-1414382737-268919432-1000\IAS_TEST /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-2101206053-1414382737-268919432-1000\Software\DownloadManager" /v ExePath 2>nul3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-2101206053-1414382737-268919432-1000\Software\DownloadManager" /v ExePath4⤵
-
-
-
C:\Windows\system32\reg.exereg add HKU\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg query HKU\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST3⤵
-
-
C:\Windows\system32\reg.exereg delete HKU\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exereg export HKCU\Software\Classes\Wow6432Node\CLSID "C:\Windows\Temp\_Backup_HKCU_CLSID_20261025-002258224.reg"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Email"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "Serial"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "scansk"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "radxcnt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LstCheck"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$sid = 'S-1-5-21-2101206053-1414382737-268919432-1000'; $HKCUsync = 1; $lockKey = $null; $deleteKey = 1; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':regscan\:.*';iex ($f[1])"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " " /f3⤵
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "Admin" /f3⤵
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /q "%TEMP%\MAS*.ps1" "%TEMP%\*UPDT.vbs" "%TEMP%\*WININF.vbs" 2>nul2⤵
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe"C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe" -runcm2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0xf4,0x7ffa21d9c728,0x7ffa21d9c734,0x7ffa21d9c7402⤵
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"2⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"2⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x168,0x7ffa1155c188,0x7ffa1155c194,0x7ffa1155c1a03⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,16860288032197505604,17309561390921645749,262144 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,12233289766716987367,17299561928732919373,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,16912660995576786230,9619611934028503207,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12567920178769864952,14973072867863944496,2097152 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,2414450911729774426,16102788417597647925,2097152 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,4860703497184862380,9523023533710109161,2097152 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,14867435341691521909,5651637175412045692,2097152 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,1135862576997355040,15905769415583305422,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,4572264463106663091,12844796640355378352,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3306747600315412403,4403781720943587960,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,726806285144175236,12819469366817902812,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,11984778818681275250,5541251560559282010,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5880,i,15610312611773412749,4798057698573258585,2097152 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6012,i,3856120087214000951,10570354794643892171,2097152 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,8854610070304285238,6820690141888141486,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,16996685854793042765,17956730493910522599,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,16177648896085182857,11107279582943275138,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,16177648896085182857,11107279582943275138,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,2076504618864652759,5682002949989215104,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,12194149572185547437,3503236053902202103,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:83⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.1cb075318e32ab73 > \\.\pipe\chrome.nativeMessaging.out.1cb075318e32ab733⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=04⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,14110780438187192815,14365156184981704525,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,14170475768047226436,11631815982624278440,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,6634289400653671577,17544112451678300745,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:83⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.357bf264c8eea7c7 > \\.\pipe\chrome.nativeMessaging.out.357bf264c8eea7c73⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=04⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3548,i,5409768588112872507,6420185551664616928,2097152 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:13⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.9bbd86fb51987fb0 > \\.\pipe\chrome.nativeMessaging.out.9bbd86fb51987fb03⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=04⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,5374335303806064047,17446615270989919613,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,7302777826129947627,16218265510283026070,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,6590249298483972441,9420593308804829371,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,7127875128613607152,7641826025767836917,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:83⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.fe49b4ad51917ced > \\.\pipe\chrome.nativeMessaging.out.fe49b4ad51917ced3⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=04⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,2100886376799917822,9117199873287401025,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:83⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.a0e0e89676178c0d > \\.\pipe\chrome.nativeMessaging.out.a0e0e89676178c0d3⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=04⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,10629572587574193210,10478655058973499849,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:83⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.140e7d80d54bd9b9 > \\.\pipe\chrome.nativeMessaging.out.140e7d80d54bd9b93⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=04⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,18031557383047185211,8899268346139795358,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:83⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.c53018bcc316d57c > \\.\pipe\chrome.nativeMessaging.out.c53018bcc316d57c3⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://llbjbkhnmlidjebalopleeepgdfgcpec/ --parent-window=04⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6924,i,13044209885474877433,10835581145912602211,262144 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15871796836472058399,10476529827083849718,524288 --field-trial-handle=2280,i,14761925581793285606,12885361298104586910,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\Read me first.txt1⤵
-
C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\IDM_6.4x_Crack_v20.7\IDM_6.4x_Crack_v20.7.exe"C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\IDM_6.4x_Crack_v20.7\IDM_6.4x_Crack_v20.7.exe"1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\IDM_UPDT_n6ikl4c.vbs" "https://www.internetdownloadmanager.com/idm.xml" "Program_Version" "Primary_Download_URL" "6.43.16.2" "IDM" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_yo7bxg3.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.7" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -Command "irm https://christitus.com/win | iex"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iylji3r4\iylji3r4.cmdline"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES182E.tmp" "c:\Users\Admin\AppData\Local\Temp\iylji3r4\CSCDDD822F925E48F59373F8B6C2C369.TMP"4⤵
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /q "%TEMP%\MAS*.ps1" "%TEMP%\*UPDT.vbs" "%TEMP%\*WININF.vbs" 2>nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Internet Download Manager 6.43 Build 16 Multilingual + Retail\IDM_6.4x_Crack_v20.7\Changelog.txt1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
IDMGetAll.dll
IDMGetAll64.dll
IDMIECC.dll
IDMIECC64.dll
IDMNetMon64.dll
IDMShellExt64.dll
IDMan.exe
downlWithIDM.dll
downlWithIDM64.dll
idmBroker.exe
idmfsa.dll
protocols.json
nav_config.json
08f58a15-1d00-47d0-b584-2feef2eaea5f.tmp
1929f1a2-85c7-4a5a-ab9e-21035f89a339.tmp
1f55cfc7-b9fb-483c-8f2d-123b92d81ba4.tmp
6c178bc1-584c-4e5c-9b6f-7aba9488f005.tmp
87ab43e5-6749-44e7-b2b4-3c7d22334349.tmp
8de5de85-93af-4be3-ace7-c5613ba29cf4.tmp
settings.dat
09377c34-a365-4288-ac85-78cdc341e49e.tmp
15a3b1a4-00a0-422c-b58c-cd7923760a4a.tmp
1cd3fd0e-1e1c-460a-9a59-add3b3b46dd4.tmp
50a77452-13f3-4024-8497-537e8d97f9c3.tmp
531085ba-fd0e-4e91-b266-cd3d5f84eea1.tmp
7169d997-e9c7-4c49-b498-7362b4b7d12b.tmp
8f9f8a8b-dfa0-49f1-8852-77c0b29d420d.tmp
f_000005
f_000007
f_00000a
f_00000b
f_00000c
f_000020
f_000045
f_000053
07daf381f06e279c_0
d7404140a53bf389_0
temp-index
temp-index
temp-index
temp-index
background.js
CURRENT
6a0b8550-fca1-4087-8e90-306dda6bb4ef.tmp
a1b4b116-6781-431e-a6ab-acdfcb18fedf.tmp
bd06e55b-40f7-4ee9-bb72-28fef61fc897.tmp
f1df3802-f16d-45e7-a491-f305d5d80f5b.tmp
temp-index
temp-index
the-real-index
temp-index
temp-index
a047e185-4fcd-441a-8a15-dd2fb09f9f9b.tmp
aafb37af-632e-496e-b564-bb792f165d69.tmp
d0753dcc-f856-4a3b-9a11-b7339c8582fd.tmp
e11f4cba-c7a5-47cb-8c72-0d106d8e1678.tmp
e8185e88-b2ca-4966-bba5-3081321a3891.tmp
e9214bd7-70c1-49c3-88b9-b13d6cd49833.tmp
Local State
d3c21d76-acac-4cd8-a47e-d68d3b2881b0.tmp
da37b89e-df2f-414b-9e33-b133ab81c7ba.tmp
3f85b4d7-48d9-44ea-976a-aae60d1d569a.tmp
5473b37b-b9aa-48d6-8d33-e9b4d1cc39be.tmp
75c8fc47-c1b9-4236-81ab-c017edc1cf9f.tmp
80deff9c-c047-4115-8e23-3f0417f68c24.tmp
8d0238b8-bb91-41fb-bb59-9b50160783dd.tmp
manifest.json
37a60430-6708-449e-9d1d-d86da032de11.dmp
settings.dat
settings.dat
0e026bb1-d660-4c30-aeb3-11d7644057ff.tmp
1d068080-d64a-42de-a53f-78ac972d2d9f.tmp
43b55827-4fa6-4209-bea3-bc2f0e83a1d0.tmp
9343e2df-4d92-41ba-817e-42b1980373f4.tmp
96675eb8-0020-431b-969c-03349e87f9d6.tmp
LOG.old
temp-index
the-real-index
190fb8f0-5710-4a71-98be-d1b3db745865.tmp
background.js
dasherSettingSchema.json
MANIFEST-000001
8c7d654c-ec49-48bb-9320-595de00a4871.tmp
faf5b2d3-9b32-4673-915e-61152f1cb2c3.tmp
temp-index
the-real-index
index.txt.tmp
sync_diagnostic.log
752c0027-06b7-48e1-8dbc-796897b1adf8.tmp
manifest.json
manifest.json
c726ae98-3ce0-4f71-bf16-bd3e586d823a.tmp
14ae90b1-b496-4aa2-ac56-227931eb63de.tmp
488a4cb3-907f-49a3-b77b-7ebb54fa5560.tmp
95b96613-9e3e-4e37-a2e8-4db71929f314.tmp
b533dbe9-5121-43c0-836d-662052ffc31f.tmp
f89799a2-344c-49b4-abe3-005e1a27e7ee.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
WPF24A5.tmp
WPF2921.tmp
WPF29EF.tmp
WPF2F94.tmp
activity-stream.contile.json
activity-stream.discovery_stream.json
activity-stream.discovery_stream.json
E9338C5CCF1E2FCF149487351399F198A4F9FCD6
webext.sc.lz4
webext.sc.lz4
9407159f-5e0b-4516-ac05-bbce223af1db.tmp
CRK_UPDT_yo7bxg3.vbs
IDM1.tmp
IDMSetup2.log
__PSScriptPolicyTest_xfx13s5q.v5k.ps1
messages.json
a4eec51d-b4a1-4335-83d4-1804ca505108.tmp
content.js
de44fe2b-e0c3-4e4b-be51-8cc2c0cea60e.tmp
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
captured.html
content.js
debug.js
logo128.png
logo32.png
logo48.png
manifest.json
IDMEdgeExt.crx
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
captured.html
captured.js
content.js
debug.js
document.js
headBkgd.gif
headTitle.gif
logo128.png
logo16.png
logo16.png
logo16x.png
logo32.png
logo32x.png
logo48.png
logoTonec.gif
manifest.json
welcome.html
welcome.js
IDMGCExt.crx
tmpaddon
tmpaddon
tmpaddon
idmwfp.cat
idmwfp.inf
idmwfp64.sys
www_internetdownload
idmcchandler2.dll
idmcchandler2_64.dll
2OZCWU4I3R8XP0SDHUYI.temp
5d696d521de238c3.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
NS3J5TC5RWM2X1DIBJAX.temp
RQKTXPGADKFRNNO0PIRI.temp
addonStartup.json.lz4
broadcast-listeners.json
store.json.mozlz4
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
592c4307-8bba-4901-a59e-b8d43cca1a68
60be43a9-f3b3-441b-8de4-38e830ac663e
71d2e1c1-5967-487f-ae47-8f6bf641ad43
9dea8bed-af4f-48a0-92bd-67432fec6d9c
f2c53668-95e1-4637-bef3-b2000a42c960
extension-preferences.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
prefs-1.js
prefs.js
prefs.js
sessionCheckpoints.json
sessionCheckpoints.json
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
targeting.snapshot.json
xulstore.json
Internet Download Manager 6.43 Build 16 Multilingual + Retail [FileCR].zip
IDM_6.4x_Crack_v20.7.zip
Read me first.txt
idman643build16.exe
d92ce9e4-9993-4d7c-9342-7cda56693f06.tmp
_Backup_HKCU_CLSID_20261025-002258224.reg
memory/1728-1168-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1728-1011-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2324-277-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2324-747-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2796-2048-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5224-1910-0x00000202B4BD0000-0x00000202B4BF2000-memory.dmp
memory/5832-1203-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6300-2096-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6432-1631-0x0000000000400000-0x000000000043B000-memory.dmp
memory/6432-2006-0x0000000000400000-0x000000000043B000-memory.dmp
memory/6432-2005-0x0000000000400000-0x000000000043B000-memory.dmp
memory/6432-2038-0x0000000000400000-0x000000000043B000-memory.dmp
memory/6516-2077-0x0000000000400000-0x000000000042B000-memory.dmp
memory/7720-3595-0x0000000007850000-0x000000000786A000-memory.dmp
memory/7720-3600-0x00000000088B0000-0x00000000088E2000-memory.dmp
memory/7720-3614-0x0000000008B30000-0x0000000008B7A000-memory.dmp
memory/7720-3615-0x0000000008C60000-0x0000000008CF2000-memory.dmp
memory/7720-3623-0x0000000008DA0000-0x0000000008DA8000-memory.dmp
memory/7720-3624-0x0000000009920000-0x0000000009928000-memory.dmp
memory/7720-3625-0x000000000CFE0000-0x000000000D018000-memory.dmp
memory/7720-3626-0x000000000C300000-0x000000000C30E000-memory.dmp
memory/7720-3627-0x00000000106B0000-0x0000000010836000-memory.dmp
memory/7720-3628-0x000000000CEA0000-0x000000000CEAA000-memory.dmp
memory/7720-3612-0x0000000008A10000-0x0000000008A21000-memory.dmp
memory/7720-3611-0x00000000089E0000-0x00000000089EA000-memory.dmp
memory/7720-3610-0x00000000088F0000-0x0000000008993000-memory.dmp
memory/7720-3601-0x000000006E270000-0x000000006E2BC000-memory.dmp
memory/7720-3609-0x00000000086B0000-0x00000000086CE000-memory.dmp
memory/7720-3613-0x0000000009940000-0x0000000009E6C000-memory.dmp
memory/7720-3599-0x0000000008E60000-0x0000000009404000-memory.dmp
memory/7720-3598-0x0000000007E30000-0x0000000007E52000-memory.dmp
memory/7720-3597-0x00000000085B0000-0x0000000008646000-memory.dmp
memory/7720-3596-0x00000000086E0000-0x00000000088A2000-memory.dmp
memory/7720-3594-0x0000000007E90000-0x000000000850A000-memory.dmp
memory/7720-3593-0x00000000067F0000-0x000000000683C000-memory.dmp
memory/7720-3592-0x00000000067A0000-0x00000000067BE000-memory.dmp
memory/7720-3591-0x0000000006380000-0x00000000066D4000-memory.dmp
memory/7720-3583-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/7720-3582-0x0000000005A90000-0x0000000005AF6000-memory.dmp
memory/7720-3579-0x00000000033F0000-0x0000000003426000-memory.dmp
memory/7720-3581-0x0000000005930000-0x0000000005952000-memory.dmp
memory/7720-3580-0x0000000005C50000-0x0000000006278000-memory.dmp
memory/8572-4005-0x0000000000400000-0x000000000043B000-memory.dmp
memory/8572-3574-0x0000000000400000-0x000000000043B000-memory.dmp