Overview

overview

9

Static

static

3

2026-11-09...at.exe

windows10-2004-x64

9

2026-11-09...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/11/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_63354e985fa76bccdced6f4d703eb530_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe
  • Size 12.0MB
  • Sample261110-wez76act2x
  • SHA256 acfa400b2349783767e34a39f0e31a381bf07c7deffdd17028c3cb9e1e61552c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Custom signature
    Detects executables built or packed with MPress PE compressor 3 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Blocks application from running via registry modification 1 IoCs

    Adds application to list of disallowed applications.

    defense_evasion
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 1 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 24 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_63354e985fa76bccdced6f4d703eb530_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_63354e985fa76bccdced6f4d703eb530_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "IDMan.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5604
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build17f.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build17f.exe" /skipdlgs
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5304
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\" -skdlgs
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4700
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4256
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5916
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4340
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4376
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:3628
        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4860
        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr /onsilentsetup
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:404
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1052
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
              6⤵
              • Loads dropped DLL
              PID:4544
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5076
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:4500
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5048
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:2400
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3700
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:5852
    • C:\Windows\SysWOW64\timeout.exe
      "C:\Windows\System32\timeout.exe" /t 3
      2⤵
      • System Location Discovery: System Language Discovery
      • Delays execution with timeout.exe
      PID:4964
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "IDMan.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3236
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.7.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.7.exe" -silent
      2⤵
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3856
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:728
      • C:\Windows\SysWOW64\reg.exe
        reg.exe import C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5336
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5212
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:2396
        • C:\Windows\system32\reg.exe
          reg query "HKCU\Console" /v ForceV2
          4⤵
            PID:3928
          • C:\Windows\system32\find.exe
            find /i "0x0"
            4⤵
              PID:2028
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1440
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2980
              • C:\Windows\system32\cmd.exe
                cmd
                5⤵
                  PID:4440
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat" "
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3020
              • C:\Windows\system32\find.exe
                find /i "C:\Users\Admin\AppData\Local\Temp"
                4⤵
                  PID:4052
                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':PowerShellTest:\s*';iex ($f[1])"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3452
                • C:\Windows\system32\find.exe
                  find /i "FullLanguage"
                  4⤵
                    PID:2832
                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3976
                  • C:\Windows\system32\find.exe
                    find /i "computersystem"
                    4⤵
                      PID:4524
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul
                      4⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5848
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5764
                    • C:\Windows\system32\reg.exe
                      reg query HKU\\Software
                      4⤵
                        PID:5656
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul
                        4⤵
                        • Executes a command shell one-liner
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:596
                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"
                          5⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5576
                      • C:\Windows\system32\reg.exe
                        reg query HKU\S-1-5-21-2091445952-3649787497-104050984-1000\Software
                        4⤵
                          PID:1644
                        • C:\Windows\system32\reg.exe
                          reg delete HKCU\IAS_TEST /f
                          4⤵
                          • Modifies registry key
                          PID:1696
                        • C:\Windows\system32\reg.exe
                          reg delete HKU\S-1-5-21-2091445952-3649787497-104050984-1000\IAS_TEST /f
                          4⤵
                            PID:4040
                          • C:\Windows\system32\reg.exe
                            reg add HKCU\IAS_TEST
                            4⤵
                            • Modifies registry key
                            PID:5340
                          • C:\Windows\system32\reg.exe
                            reg query HKU\S-1-5-21-2091445952-3649787497-104050984-1000\IAS_TEST
                            4⤵
                              PID:5972
                            • C:\Windows\system32\reg.exe
                              reg delete HKCU\IAS_TEST /f
                              4⤵
                              • Modifies registry key
                              PID:3804
                            • C:\Windows\system32\reg.exe
                              reg delete HKU\S-1-5-21-2091445952-3649787497-104050984-1000\IAS_TEST /f
                              4⤵
                                PID:5820
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
                                4⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5352
                                • C:\Windows\system32\reg.exe
                                  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
                                  5⤵
                                    PID:3360
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-2091445952-3649787497-104050984-1000\Software\DownloadManager" /v ExePath 2>nul
                                  4⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4736
                                  • C:\Windows\system32\reg.exe
                                    reg query "HKU\S-1-5-21-2091445952-3649787497-104050984-1000\Software\DownloadManager" /v ExePath
                                    5⤵
                                      PID:6072
                                  • C:\Windows\system32\reg.exe
                                    reg add HKU\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
                                    4⤵
                                      PID:1752
                                    • C:\Windows\system32\reg.exe
                                      reg query HKU\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
                                      4⤵
                                        PID:4812
                                      • C:\Windows\system32\reg.exe
                                        reg delete HKU\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f
                                        4⤵
                                          PID:4820
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"
                                          4⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4532
                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"
                                            5⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:860
                                        • C:\Windows\system32\reg.exe
                                          reg export HKCU\Software\Classes\Wow6432Node\CLSID "C:\Windows\Temp\_Backup_HKCU_CLSID_20261110-175107890.reg"
                                          4⤵
                                            PID:616
                                          • C:\Windows\system32\reg.exe
                                            reg query "HKCU\Software\DownloadManager" "/v" "Email"
                                            4⤵
                                              PID:2316
                                            • C:\Windows\system32\reg.exe
                                              reg query "HKCU\Software\DownloadManager" "/v" "Serial"
                                              4⤵
                                                PID:4752
                                              • C:\Windows\system32\reg.exe
                                                reg query "HKCU\Software\DownloadManager" "/v" "scansk"
                                                4⤵
                                                  PID:3640
                                                • C:\Windows\system32\reg.exe
                                                  reg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"
                                                  4⤵
                                                    PID:2100
                                                  • C:\Windows\system32\reg.exe
                                                    reg query "HKCU\Software\DownloadManager" "/v" "radxcnt"
                                                    4⤵
                                                      PID:5332
                                                    • C:\Windows\system32\reg.exe
                                                      reg query "HKCU\Software\DownloadManager" "/v" "LstCheck"
                                                      4⤵
                                                        PID:1316
                                                      • C:\Windows\system32\reg.exe
                                                        reg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"
                                                        4⤵
                                                          PID:4964
                                                        • C:\Windows\system32\reg.exe
                                                          reg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"
                                                          4⤵
                                                            PID:5624
                                                          • C:\Windows\system32\reg.exe
                                                            reg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"
                                                            4⤵
                                                              PID:4680
                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell.exe "$sid = 'S-1-5-21-2091445952-3649787497-104050984-1000'; $HKCUsync = 1; $lockKey = $null; $deleteKey = 1; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':regscan\:.*';iex ($f[1])"
                                                              4⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1172
                                                            • C:\Windows\system32\chcp.com
                                                              chcp 65001
                                                              4⤵
                                                                PID:5696
                                                              • C:\Windows\system32\reg.exe
                                                                REG ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f
                                                                4⤵
                                                                  PID:4788
                                                                • C:\Windows\system32\reg.exe
                                                                  REG ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f
                                                                  4⤵
                                                                    PID:5248
                                                                  • C:\Windows\system32\reg.exe
                                                                    REG ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f
                                                                    4⤵
                                                                      PID:2160
                                                                    • C:\Windows\system32\reg.exe
                                                                      REG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " " /f
                                                                      4⤵
                                                                        PID:3060
                                                                      • C:\Windows\system32\reg.exe
                                                                        REG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "Admin" /f
                                                                        4⤵
                                                                          PID:4544
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "TipStartUp" /t REG_DWORD /d "1" /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6124
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "FName" /t REG_SZ /d "Catz Friends" /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3092
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "LName" /t REG_SZ /d " " /f
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2624

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        IDMGetAll.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                                                                        • Size 73KB
                                                                        • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDMGetAll64.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                                                                        • Size 93KB
                                                                        • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDMIECC.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                                                                        • Size 463KB
                                                                        • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDMIECC64.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                                                                        • Size 656KB
                                                                        • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDMNetMon64.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                                                                        • Size 572KB
                                                                        • SHA256 629ae3c80dd0640011f8745af9756a19c16ba5e4921028b21f92a0cc1928e8a9
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDMShellExt64.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                                                                        • Size 36KB
                                                                        • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDMan.exe
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                                                                        • Size 6.2MB
                                                                        • SHA256 9a26f61345aa152fd28c1d63da368354698c7ab09d2826eb69782b86c01563c9
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        downlWithIDM.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                                                                        • Size 197KB
                                                                        • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        downlWithIDM64.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                                                                        • Size 155KB
                                                                        • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        idmBroker.exe
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                                                                        • Size 153KB
                                                                        • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        idmfsa.dll
                                                                        • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                                                                        • Size 90KB
                                                                        • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        powershell.exe.log
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                        • Size 2KB
                                                                        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 f9dd47fc9850446acf7187e22ab7bada69375a2c80d076daab64717cf19d93df
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 52d6fafd5d1d6b3ba7d86c578e58dd38b2226866687fc4dcdf67eb1de2171e8f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 7e99d4f44d0493f06d62443009f43b9992e052d4db4ff0913d0afb84ea15b93f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 a006eea99499e4f6715f1577581ab6dc5938cf4037882ce28563e2a5c75576b3
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        BATCLEN.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat
                                                                        • Size 19KB
                                                                        • SHA256 12b47c1949cc555c2f68f9fd4677ed5266f25c4da4630bec36e303629b133225
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDMRegClean.reg
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg
                                                                        • Size 5KB
                                                                        • SHA256 4c0e2396b9fca1bbeb36e9ebb27f27e63cd2662abf8b18f042d872322e1363eb
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDM1.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                                                                        • Size 163KB
                                                                        • SHA256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDMSetup2.log
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                        • Size 598B
                                                                        • SHA256 edbc516070517786ceee7edb5ea48f240036297d89010312c10b42f4a63300ff
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        IDMSetup2.log
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                        • Size 1KB
                                                                        • SHA256 dbf33188970edcc1e981bf27e40a7c22f6f599c3647d24d90891711717bb6fd4
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        IDMSetup2.log
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                        • Size 1KB
                                                                        • SHA256 32b434c256343a7f6f836554d38b4444c67ff0bfa72f833a7518d0c97e192c03
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        IDMSetup2.log
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                        • Size 3KB
                                                                        • SHA256 3ca1de398ac5f5ef1db4424d9ba672bc5eddf9cbfc1a164faa5630cc4b2f8ada
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        IDMSetup2.log
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                        • Size 4KB
                                                                        • SHA256 2a15c9016d94450381ce04646eb7407bdcff3f0435ad3d079d1c7308b6ced65b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        IDM_6.4x_Crack_v20.7.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.7.exe
                                                                        • Size 55KB
                                                                        • SHA256 8eaa420d3c8e7aa450d79f8635c2de5c8f8038a3d3ee3775a3cb7e411d2181fc
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        idman643build17f.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build17f.exe
                                                                        • Size 11.6MB
                                                                        • SHA256 88a73ebf8ee12538a35430878cb786d2e257c980c293a532b2222d08fd593b62
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        WININF.vbs
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WININF.vbs
                                                                        • Size 2KB
                                                                        • SHA256 f4a33112450eba45ee2738001352e3af5e977194610a127ee4a8feef4c44568e
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        __PSScriptPolicyTest_d41trz04.qfn.ps1
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d41trz04.qfn.ps1
                                                                        • Size 60B
                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        _Backup_HKCU_CLSID_20261110-175107890.reg
                                                                        • Path C:\Windows\Temp\_Backup_HKCU_CLSID_20261110-175107890.reg
                                                                        • Size 32KB
                                                                        • SHA256 357e1fb247f831c9b4a0363445a0a7446af42dea4585f5c7357391e5732f4b2c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        memory/2808-444-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                        Download

                                                                        memory/2808-15-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                        Download

                                                                        memory/3452-485-0x000001E8CEF40000-0x000001E8CEF62000-memory.dmp
                                                                        Download

                                                                        memory/3856-468-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                        Download

                                                                        memory/3856-540-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                        Download