cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

Analysis

max time kernel
9s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Size

17KB
MD5

bf989a6d369cb708ddbeb95ed702e1ad
SHA1

2989e7c2933c80727ebe847d86da349cd35dfcab
SHA256

cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8
SHA512

68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019
SSDEEP

384:I/76FphKn+yaQZBceAhUJtkLi7Z0szBOArx3nsK:fP8BaQMeAhK6W7ZzoArB/

Score

8^/10

adware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1264	ismhasrv.exe
1068	ismhasrv.exe
2016	ismhasrv.exe
1880	ismhasrv.exe
1548	ismhasrv.exe
1668	ismhasrv.exe
1504	ismhasrv.exe
1592	ismhasrv.exe

Loads dropped DLL 16 IoCs

pid	Process
1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
1264	ismhasrv.exe
1264	ismhasrv.exe
1068	ismhasrv.exe
1068	ismhasrv.exe
2016	ismhasrv.exe
2016	ismhasrv.exe
1880	ismhasrv.exe
1880	ismhasrv.exe
1548	ismhasrv.exe
1548	ismhasrv.exe
1668	ismhasrv.exe
1668	ismhasrv.exe
1504	ismhasrv.exe
1504	ismhasrv.exe

Installs/modifies Browser Helper Object 2 TTPs 16 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\ = "mnmhgsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\ = "mnmhgsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\ = "mnmhgsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\ = "mnmhgsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\ = "mnmhgsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\ = "mnmhgsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\ = "mnmhgsrv.dll"	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\ = "mnmhgsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	ismhasrv.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File created	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File created	C:\Windows\SysWOW64\mnmhgsrv.dll	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File created	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhgsrv.dll	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhgsrv.dll	ismhasrv.exe
File created	C:\Windows\SysWOW64\ismhasrv.exe	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhgsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ThreadingModel = "Apartment"	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhgsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhgsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhgsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhgsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhgsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhgsrv.dll"	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C8D1401-A58D-A81C-CD24-A5915C4517C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhgsrv.dll"	ismhasrv.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
1264	ismhasrv.exe
1068	ismhasrv.exe
2016	ismhasrv.exe
1880	ismhasrv.exe
1548	ismhasrv.exe
1668	ismhasrv.exe
1504	ismhasrv.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
Token: SeDebugPrivilege	1264	ismhasrv.exe
Token: SeDebugPrivilege	1068	ismhasrv.exe
Token: SeDebugPrivilege	2016	ismhasrv.exe
Token: SeDebugPrivilege	1880	ismhasrv.exe
Token: SeDebugPrivilege	1548	ismhasrv.exe
Token: SeDebugPrivilege	1668	ismhasrv.exe
Token: SeDebugPrivilege	1504	ismhasrv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2004	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe	28
PID 1280 wrote to memory of 2004	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe	28
PID 1280 wrote to memory of 2004	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe	28
PID 1280 wrote to memory of 2004	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe	28
PID 1280 wrote to memory of 1264	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe	30
PID 1280 wrote to memory of 1264	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe	30
PID 1280 wrote to memory of 1264	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe	30
PID 1280 wrote to memory of 1264	1280	cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe	30
PID 1264 wrote to memory of 1752	1264	ismhasrv.exe	31
PID 1264 wrote to memory of 1752	1264	ismhasrv.exe	31
PID 1264 wrote to memory of 1752	1264	ismhasrv.exe	31
PID 1264 wrote to memory of 1752	1264	ismhasrv.exe	31
PID 1264 wrote to memory of 1068	1264	ismhasrv.exe	33
PID 1264 wrote to memory of 1068	1264	ismhasrv.exe	33
PID 1264 wrote to memory of 1068	1264	ismhasrv.exe	33
PID 1264 wrote to memory of 1068	1264	ismhasrv.exe	33
PID 1068 wrote to memory of 1000	1068	ismhasrv.exe	34
PID 1068 wrote to memory of 1000	1068	ismhasrv.exe	34
PID 1068 wrote to memory of 1000	1068	ismhasrv.exe	34
PID 1068 wrote to memory of 1000	1068	ismhasrv.exe	34
PID 1068 wrote to memory of 2016	1068	ismhasrv.exe	36
PID 1068 wrote to memory of 2016	1068	ismhasrv.exe	36
PID 1068 wrote to memory of 2016	1068	ismhasrv.exe	36
PID 1068 wrote to memory of 2016	1068	ismhasrv.exe	36
PID 2016 wrote to memory of 1404	2016	ismhasrv.exe	37
PID 2016 wrote to memory of 1404	2016	ismhasrv.exe	37
PID 2016 wrote to memory of 1404	2016	ismhasrv.exe	37
PID 2016 wrote to memory of 1404	2016	ismhasrv.exe	37
PID 2016 wrote to memory of 1880	2016	ismhasrv.exe	39
PID 2016 wrote to memory of 1880	2016	ismhasrv.exe	39
PID 2016 wrote to memory of 1880	2016	ismhasrv.exe	39
PID 2016 wrote to memory of 1880	2016	ismhasrv.exe	39
PID 1880 wrote to memory of 288	1880	ismhasrv.exe	40
PID 1880 wrote to memory of 288	1880	ismhasrv.exe	40
PID 1880 wrote to memory of 288	1880	ismhasrv.exe	40
PID 1880 wrote to memory of 288	1880	ismhasrv.exe	40
PID 1880 wrote to memory of 1548	1880	ismhasrv.exe	42
PID 1880 wrote to memory of 1548	1880	ismhasrv.exe	42
PID 1880 wrote to memory of 1548	1880	ismhasrv.exe	42
PID 1880 wrote to memory of 1548	1880	ismhasrv.exe	42
PID 1548 wrote to memory of 1672	1548	ismhasrv.exe	44
PID 1548 wrote to memory of 1672	1548	ismhasrv.exe	44
PID 1548 wrote to memory of 1672	1548	ismhasrv.exe	44
PID 1548 wrote to memory of 1672	1548	ismhasrv.exe	44
PID 1548 wrote to memory of 1668	1548	ismhasrv.exe	45
PID 1548 wrote to memory of 1668	1548	ismhasrv.exe	45
PID 1548 wrote to memory of 1668	1548	ismhasrv.exe	45
PID 1548 wrote to memory of 1668	1548	ismhasrv.exe	45
PID 1668 wrote to memory of 1768	1668	ismhasrv.exe	46
PID 1668 wrote to memory of 1768	1668	ismhasrv.exe	46
PID 1668 wrote to memory of 1768	1668	ismhasrv.exe	46
PID 1668 wrote to memory of 1768	1668	ismhasrv.exe	46
PID 1668 wrote to memory of 1504	1668	ismhasrv.exe	48
PID 1668 wrote to memory of 1504	1668	ismhasrv.exe	48
PID 1668 wrote to memory of 1504	1668	ismhasrv.exe	48
PID 1668 wrote to memory of 1504	1668	ismhasrv.exe	48
PID 1504 wrote to memory of 1900	1504	ismhasrv.exe	49
PID 1504 wrote to memory of 1900	1504	ismhasrv.exe	49
PID 1504 wrote to memory of 1900	1504	ismhasrv.exe	49
PID 1504 wrote to memory of 1900	1504	ismhasrv.exe	49
PID 1504 wrote to memory of 1592	1504	ismhasrv.exe	51
PID 1504 wrote to memory of 1592	1504	ismhasrv.exe	51
PID 1504 wrote to memory of 1592	1504	ismhasrv.exe	51
PID 1504 wrote to memory of 1592	1504	ismhasrv.exe	51

C:\Users\Admin\AppData\Local\Temp\cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe
"C:\Users\Admin\AppData\Local\Temp\cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7069918.bat
  2⤵
  PID:2004
- C:\Windows\SysWOW64\ismhasrv.exe
  C:\Windows\system32\ismhasrv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7070339.bat
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\ismhasrv.exe
    C:\Windows\system32\ismhasrv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7070433.bat
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\ismhasrv.exe
      C:\Windows\system32\ismhasrv.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7070589.bat
        5⤵
        
        PID:1404
    - - C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1880
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7070698.bat
        6⤵
        
        PID:288
      - C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7070838.bat
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7070948.bat
        8⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7078701.bat
        9⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7079138.bat
        10⤵
        
        PID:976
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        10⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7080120.bat
        11⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        11⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        12⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7082772.bat
        13⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        13⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7083194.bat
        14⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        14⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7122225.bat
        15⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7115892.bat
        14⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7115424.bat
        13⤵
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7114097.bat
        12⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7113083.bat
        11⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7111882.bat
        10⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7111960.bat
        9⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7110307.bat
        8⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102865.bat
        7⤵
        
        PID:3796
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102881.bat
        6⤵
        
        PID:3760
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102725.bat
        5⤵
        
        PID:3724
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102585.bat
      4⤵
      PID:3688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102491.bat
    3⤵
    PID:3636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7101711.bat
  2⤵
  PID:3324

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7081977.bat
1⤵
PID:584

C:\Windows\SysWOW64\ismhasrv.exe
C:\Windows\system32\ismhasrv.exe
1⤵
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7090339.bat
  2⤵
  PID:1240
- C:\Windows\SysWOW64\ismhasrv.exe
  C:\Windows\system32\ismhasrv.exe
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7092304.bat
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\ismhasrv.exe
    C:\Windows\system32\ismhasrv.exe
    3⤵
    PID:1736
  - - C:\Windows\SysWOW64\ismhasrv.exe
      C:\Windows\system32\ismhasrv.exe
      4⤵
      PID:556
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7095487.bat
        5⤵
        
        PID:848
    - - C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        5⤵
        
        PID:904
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7095814.bat
        6⤵
        
        PID:780
      - C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        6⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7095923.bat
        7⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        7⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7096033.bat
        8⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        8⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        9⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7096267.bat
        10⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        10⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7096376.bat
        11⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        11⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7096563.bat
        12⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        12⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7096688.bat
        13⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        13⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7097749.bat
        14⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        14⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7097873.bat
        15⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        15⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098014.bat
        16⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        16⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098107.bat
        17⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        17⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098248.bat
        18⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        18⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098388.bat
        19⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        19⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098482.bat
        20⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        20⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098607.bat
        21⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        21⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098669.bat
        22⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        22⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098763.bat
        23⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        23⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098841.bat
        24⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        24⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098919.bat
        25⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        25⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7098997.bat
        26⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        26⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7099090.bat
        27⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        27⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7099184.bat
        28⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        28⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7099293.bat
        29⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        29⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7099355.bat
        30⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        30⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100089.bat
        31⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        31⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100229.bat
        32⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        32⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100291.bat
        33⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        33⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100369.bat
        34⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        34⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100479.bat
        35⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        35⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100572.bat
        36⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        36⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100681.bat
        37⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        37⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100744.bat
        38⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        38⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100853.bat
        39⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        39⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7100962.bat
        40⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        40⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7101071.bat
        41⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        41⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7101149.bat
        42⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        42⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7101290.bat
        43⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        43⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7101758.bat
        44⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        44⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7101883.bat
        45⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        45⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7101992.bat
        46⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        46⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102070.bat
        47⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        47⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102163.bat
        48⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        48⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102257.bat
        49⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        49⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102335.bat
        50⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        50⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102444.bat
        51⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        51⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102553.bat
        52⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        52⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        53⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7102881.bat
        54⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        54⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        55⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7106188.bat
        56⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        56⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7110868.bat
        57⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        57⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7112491.bat
        58⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        58⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7114441.bat
        59⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        59⤵
        
        PID:624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7114862.bat
        60⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        60⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7115689.bat
        61⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        61⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7118528.bat
        62⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        62⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7122241.bat
        63⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        63⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7123489.bat
        64⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        64⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7127389.bat
        65⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        65⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128418.bat
        66⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        66⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7129417.bat
        67⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        67⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7129854.bat
        68⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        68⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130883.bat
        69⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        69⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7133863.bat
        70⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        70⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7137685.bat
        71⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        71⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7140836.bat
        72⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        72⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7142770.bat
        73⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        73⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7145454.bat
        74⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        74⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7148465.bat
        75⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        75⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7151335.bat
        76⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        76⤵
        
        PID:684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7155469.bat
        77⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        77⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7159213.bat
        78⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        78⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7163300.bat
        79⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        79⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7168105.bat
        80⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        80⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7170975.bat
        81⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        81⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7174080.bat
        82⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        82⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7177184.bat
        83⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        83⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7181474.bat
        84⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        84⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7184984.bat
        85⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        85⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7188354.bat
        86⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        86⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7190803.bat
        87⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        87⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7193970.bat
        88⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        88⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7198073.bat
        89⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        89⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7201271.bat
        90⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        90⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7203034.bat
        91⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        91⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7206715.bat
        92⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        92⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7210818.bat
        93⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        93⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7214687.bat
        94⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        94⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7218400.bat
        95⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7217152.bat
        84⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7213767.bat
        83⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7209399.bat
        82⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7206232.bat
        81⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7202987.bat
        80⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7200132.bat
        79⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7195686.bat
        78⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7191193.bat
        77⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7187418.bat
        76⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7183549.bat
        75⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7180710.bat
        74⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7177746.bat
        73⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7175297.bat
        72⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7172957.bat
        71⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7169774.bat
        70⤵
        
        PID:624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7165827.bat
        69⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7163207.bat
        68⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7162271.bat
        67⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7161662.bat
        66⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7160757.bat
        65⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7158105.bat
        64⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7154595.bat
        63⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7153597.bat
        62⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7148199.bat
        61⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7147763.bat
        60⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7146889.bat
        59⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7146499.bat
        58⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7144237.bat
        57⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7140243.bat
        56⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7105159.bat
        55⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7137482.bat
        55⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7137045.bat
        54⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7135376.bat
        53⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7135033.bat
        52⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134986.bat
        51⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134081.bat
        50⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134830.bat
        49⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134081.bat
        48⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134081.bat
        47⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134081.bat
        46⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134081.bat
        45⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134066.bat
        44⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7134081.bat
        43⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7133660.bat
        42⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132802.bat
        41⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132740.bat
        40⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132802.bat
        39⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132724.bat
        38⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132802.bat
        37⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132474.bat
        36⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132911.bat
        35⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132724.bat
        34⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132646.bat
        32⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132459.bat
        31⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7132350.bat
        30⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7131507.bat
        29⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7131351.bat
        28⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7131382.bat
        27⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7131289.bat
        26⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7131195.bat
        25⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7131102.bat
        24⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130868.bat
        23⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130790.bat
        22⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130977.bat
        21⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130041.bat
        20⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130041.bat
        19⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130041.bat
        18⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130041.bat
        17⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7129947.bat
        16⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7130041.bat
        15⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7129854.bat
        14⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7129791.bat
        13⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128637.bat
        12⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128652.bat
        11⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128418.bat
        10⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7096173.bat
        9⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128574.bat
        9⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128621.bat
        8⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128902.bat
        7⤵
        
        PID:4448
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7127295.bat
        6⤵
        
        PID:3912
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7127545.bat
        5⤵
        
        PID:4160
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7127342.bat
      4⤵
      PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7127701.bat
    3⤵
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7123489.bat
  2⤵
  PID:3100

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7084504.bat
1⤵
PID:1008

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7093100.bat
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFD7069918.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7070339.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7070433.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7070589.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7070698.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7070838.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7070948.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7078701.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7079138.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7080120.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7081977.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7082772.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7083194.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
C:\Windows\SysWOW64\mnmhgsrv.dll

Filesize
525KB

MD5
5e4e152bab0f840264bd6ca934216808

SHA1
6205dfd226af35a67ec126a91c552b42c95b0e7b

SHA256
4f955f012dba6f1b09a0a8b1e4c5f765806c55cb40d20ce9ee30df75c60a45b9

SHA512
260ed3c4f7b708b619d91c8fa646ec993f560a12853434219b59082be0da232ee1040079486e8da0c12094708b90cf680003de567ed320ab4b6db16158fb2ba4

Download Submit
C:\Windows\SysWOW64\mnmhgsrv.dll

Filesize
525KB

MD5
5e4e152bab0f840264bd6ca934216808

SHA1
6205dfd226af35a67ec126a91c552b42c95b0e7b

SHA256
4f955f012dba6f1b09a0a8b1e4c5f765806c55cb40d20ce9ee30df75c60a45b9

SHA512
260ed3c4f7b708b619d91c8fa646ec993f560a12853434219b59082be0da232ee1040079486e8da0c12094708b90cf680003de567ed320ab4b6db16158fb2ba4

Download Submit
C:\Windows\SysWOW64\mnmhgsrv.dll

Filesize
525KB

MD5
5e4e152bab0f840264bd6ca934216808

SHA1
6205dfd226af35a67ec126a91c552b42c95b0e7b

SHA256
4f955f012dba6f1b09a0a8b1e4c5f765806c55cb40d20ce9ee30df75c60a45b9

SHA512
260ed3c4f7b708b619d91c8fa646ec993f560a12853434219b59082be0da232ee1040079486e8da0c12094708b90cf680003de567ed320ab4b6db16158fb2ba4

Download Submit
C:\Windows\SysWOW64\mnmhgsrv.dll

Filesize
525KB

MD5
5e4e152bab0f840264bd6ca934216808

SHA1
6205dfd226af35a67ec126a91c552b42c95b0e7b

SHA256
4f955f012dba6f1b09a0a8b1e4c5f765806c55cb40d20ce9ee30df75c60a45b9

SHA512
260ed3c4f7b708b619d91c8fa646ec993f560a12853434219b59082be0da232ee1040079486e8da0c12094708b90cf680003de567ed320ab4b6db16158fb2ba4

Download Submit
C:\Windows\SysWOW64\mnmhgsrv.dll

Filesize
525KB

MD5
5e4e152bab0f840264bd6ca934216808

SHA1
6205dfd226af35a67ec126a91c552b42c95b0e7b

SHA256
4f955f012dba6f1b09a0a8b1e4c5f765806c55cb40d20ce9ee30df75c60a45b9

SHA512
260ed3c4f7b708b619d91c8fa646ec993f560a12853434219b59082be0da232ee1040079486e8da0c12094708b90cf680003de567ed320ab4b6db16158fb2ba4

Download Submit
C:\Windows\SysWOW64\mnmhgsrv.dll

Filesize
525KB

MD5
5e4e152bab0f840264bd6ca934216808

SHA1
6205dfd226af35a67ec126a91c552b42c95b0e7b

SHA256
4f955f012dba6f1b09a0a8b1e4c5f765806c55cb40d20ce9ee30df75c60a45b9

SHA512
260ed3c4f7b708b619d91c8fa646ec993f560a12853434219b59082be0da232ee1040079486e8da0c12094708b90cf680003de567ed320ab4b6db16158fb2ba4

Download Submit
C:\Windows\SysWOW64\mnmhgsrv.dll

Filesize
525KB

MD5
1618a8f87559255f2bbdc3c591366beb

SHA1
10c8ab3025c5240426e6ecfe7bad27b271df261e

SHA256
2d07f4a52ededadab70f95f68ad589ff6d7178cf08b74fd096b3b74c145fb289

SHA512
417d3982177d384f481c9a0e436c5502672ee531caf60720d9b415ac7aba1b1e84ff041413425f57860cf3cf45ee48e4928500b9e9649ea355cc5b5a26990d47

Download Submit
C:\Windows\SysWOW64\smmhbsrv.sys

Filesize
520B

MD5
1f3732b6bee67abb493d576016c7f43a

SHA1
5b10ac4c9f374a4ce0ea3bf57a36b0912974f931

SHA256
263a6084e3b0b3bb48b62f5019847c42b03b1155c2ab8a77201cc5fe5781d64f

SHA512
eb8b9fef98aea8c05d037cf9f258243c14fdcb761cfccce3934295d661ada5746fc46677adac243c489e6e13aeadad52e53cb87bcd3ce291ca6422306b73f878

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
bf989a6d369cb708ddbeb95ed702e1ad

SHA1
2989e7c2933c80727ebe847d86da349cd35dfcab

SHA256
cf3bcde748f3ec193948b6340c5cf9508b56b3cf7038baa22cc67def0ec3add8

SHA512
68b33efd88bdf79239294a671829fa0b9fb73082331e47d8de98d71f95a97a5a0ef3517adc465ed5039148b5744a98be2c9a1dd2775be18f8ab9efb575190019

Download Submit
memory/804-131-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/804-130-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1100-150-0x0000000000270000-0x000000000028B000-memory.dmp

Filesize
108KB

Download
memory/1100-151-0x0000000000270000-0x000000000028B000-memory.dmp

Filesize
108KB

Download
memory/1220-154-0x0000000000420000-0x000000000043B000-memory.dmp

Filesize
108KB

Download
memory/1264-98-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1280-97-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1280-96-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1504-113-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/1504-114-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/1592-127-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/1592-129-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/1668-112-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/1948-152-0x00000000002E0000-0x00000000002FB000-memory.dmp

Filesize
108KB

Download