df0b3adf6714eb2b01a66fc26d3ae9361f23765fded3f76e64b1dc32ffaf3fa8

Analysis

max time kernel
7s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Size

17KB
MD5

256365b97e98c59d72bd2efead89ca07
SHA1

804568fc8f1e32ae75fd696f0864330da3980e51
SHA256

df0b3adf6714eb2b01a66fc26d3ae9361f23765fded3f76e64b1dc32ffaf3fa8
SHA512

0d97661f61ff56bd9dd3a16945a4de086c2dda19ef937adc63c41642f3ce25a274ee71a7971a917db3c82ac406c62e759fbe18acdd5eed450f67c8343be53767
SSDEEP

384:IE76FphlmxsSblWloTdDf9V6/26RTBFv8Y32x0/HhyY19fDnHnvnHn3:wPpSbPhDMpL8RyhdnPnX

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
5704	ismhasrv.exe
5800	ismhasrv.exe
5888	ismhasrv.exe
5956	ismhasrv.exe
6048	ismhasrv.exe
6128	ismhasrv.exe
2216	ismhasrv.exe
5744	ismhasrv.exe
5920	ismhasrv.exe
4664	ismhasrv.exe
4752	ismhasrv.exe
4840	ismhasrv.exe
4948	ismhasrv.exe
4644	ismhasrv.exe

Loads dropped DLL 28 IoCs

pid	Process
2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
5704	ismhasrv.exe
5704	ismhasrv.exe
5800	ismhasrv.exe
5800	ismhasrv.exe
5888	ismhasrv.exe
5888	ismhasrv.exe
5956	ismhasrv.exe
5956	ismhasrv.exe
6048	ismhasrv.exe
6048	ismhasrv.exe
6128	ismhasrv.exe
6128	ismhasrv.exe
2216	ismhasrv.exe
2216	ismhasrv.exe
5744	ismhasrv.exe
5744	ismhasrv.exe
5920	ismhasrv.exe
5920	ismhasrv.exe
4664	ismhasrv.exe
4664	ismhasrv.exe
4752	ismhasrv.exe
4752	ismhasrv.exe
4840	ismhasrv.exe
4840	ismhasrv.exe
4948	ismhasrv.exe
4948	ismhasrv.exe

Installs/modifies Browser Helper Object 2 TTPs 30 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\ = "mnmhfsrv.dll"	ismhasrv.exe

Drops file in System32 directory 63 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mnmhfsrv.dll	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File created	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File created	C:\Windows\SysWOW64\ismhasrv.exe	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\mnmhfsrv.dll	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\smmhbsrv.sys	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\ismhasrv.exe	ismhasrv.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	ismhasrv.exe

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ismhasrv.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ThreadingModel = "Apartment"	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\mnmhfsrv.dll"	ismhasrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C8D1401-A58D-A81C-CD24-A5915C4517C6}\InprocServer32	ismhasrv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
5704	ismhasrv.exe
5704	ismhasrv.exe
5704	ismhasrv.exe
5704	ismhasrv.exe
5704	ismhasrv.exe
5800	ismhasrv.exe
5800	ismhasrv.exe
5800	ismhasrv.exe
5800	ismhasrv.exe
5800	ismhasrv.exe
5888	ismhasrv.exe
5888	ismhasrv.exe
5888	ismhasrv.exe
5888	ismhasrv.exe
5956	ismhasrv.exe
5956	ismhasrv.exe
6048	ismhasrv.exe
6128	ismhasrv.exe
2216	ismhasrv.exe
2216	ismhasrv.exe
2216	ismhasrv.exe
2216	ismhasrv.exe
2216	ismhasrv.exe
2216	ismhasrv.exe
2216	ismhasrv.exe
2216	ismhasrv.exe
5744	ismhasrv.exe
5744	ismhasrv.exe
5744	ismhasrv.exe
5744	ismhasrv.exe
5744	ismhasrv.exe
5744	ismhasrv.exe
5744	ismhasrv.exe
5920	ismhasrv.exe
5920	ismhasrv.exe
5920	ismhasrv.exe
5920	ismhasrv.exe
5920	ismhasrv.exe
5920	ismhasrv.exe
5920	ismhasrv.exe
5920	ismhasrv.exe
4664	ismhasrv.exe
4664	ismhasrv.exe
4664	ismhasrv.exe
4664	ismhasrv.exe
4664	ismhasrv.exe
4664	ismhasrv.exe
4664	ismhasrv.exe
4664	ismhasrv.exe
4752	ismhasrv.exe
4752	ismhasrv.exe
4752	ismhasrv.exe
4752	ismhasrv.exe
4752	ismhasrv.exe
4752	ismhasrv.exe
4752	ismhasrv.exe
4752	ismhasrv.exe
4840	ismhasrv.exe
4840	ismhasrv.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
Token: SeDebugPrivilege	5704	ismhasrv.exe
Token: SeDebugPrivilege	5800	ismhasrv.exe
Token: SeDebugPrivilege	5888	ismhasrv.exe
Token: SeDebugPrivilege	5956	ismhasrv.exe
Token: SeDebugPrivilege	6048	ismhasrv.exe
Token: SeDebugPrivilege	6128	ismhasrv.exe
Token: SeDebugPrivilege	2216	ismhasrv.exe
Token: SeDebugPrivilege	5744	ismhasrv.exe
Token: SeDebugPrivilege	5920	ismhasrv.exe
Token: SeDebugPrivilege	4664	ismhasrv.exe
Token: SeDebugPrivilege	4752	ismhasrv.exe
Token: SeDebugPrivilege	4840	ismhasrv.exe
Token: SeDebugPrivilege	4948	ismhasrv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2076	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe	30
PID 2464 wrote to memory of 2076	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe	30
PID 2464 wrote to memory of 2076	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe	30
PID 2464 wrote to memory of 2076	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe	30
PID 2464 wrote to memory of 5704	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe	32
PID 2464 wrote to memory of 5704	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe	32
PID 2464 wrote to memory of 5704	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe	32
PID 2464 wrote to memory of 5704	2464	256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe	32
PID 5704 wrote to memory of 5768	5704	ismhasrv.exe	33
PID 5704 wrote to memory of 5768	5704	ismhasrv.exe	33
PID 5704 wrote to memory of 5768	5704	ismhasrv.exe	33
PID 5704 wrote to memory of 5768	5704	ismhasrv.exe	33
PID 5704 wrote to memory of 5800	5704	ismhasrv.exe	35
PID 5704 wrote to memory of 5800	5704	ismhasrv.exe	35
PID 5704 wrote to memory of 5800	5704	ismhasrv.exe	35
PID 5704 wrote to memory of 5800	5704	ismhasrv.exe	35
PID 5800 wrote to memory of 5848	5800	ismhasrv.exe	36
PID 5800 wrote to memory of 5848	5800	ismhasrv.exe	36
PID 5800 wrote to memory of 5848	5800	ismhasrv.exe	36
PID 5800 wrote to memory of 5848	5800	ismhasrv.exe	36
PID 5800 wrote to memory of 5888	5800	ismhasrv.exe	38
PID 5800 wrote to memory of 5888	5800	ismhasrv.exe	38
PID 5800 wrote to memory of 5888	5800	ismhasrv.exe	38
PID 5800 wrote to memory of 5888	5800	ismhasrv.exe	38
PID 5888 wrote to memory of 5936	5888	ismhasrv.exe	39
PID 5888 wrote to memory of 5936	5888	ismhasrv.exe	39
PID 5888 wrote to memory of 5936	5888	ismhasrv.exe	39
PID 5888 wrote to memory of 5936	5888	ismhasrv.exe	39
PID 5888 wrote to memory of 5956	5888	ismhasrv.exe	41
PID 5888 wrote to memory of 5956	5888	ismhasrv.exe	41
PID 5888 wrote to memory of 5956	5888	ismhasrv.exe	41
PID 5888 wrote to memory of 5956	5888	ismhasrv.exe	41
PID 5956 wrote to memory of 6004	5956	ismhasrv.exe	42
PID 5956 wrote to memory of 6004	5956	ismhasrv.exe	42
PID 5956 wrote to memory of 6004	5956	ismhasrv.exe	42
PID 5956 wrote to memory of 6004	5956	ismhasrv.exe	42
PID 5956 wrote to memory of 6048	5956	ismhasrv.exe	44
PID 5956 wrote to memory of 6048	5956	ismhasrv.exe	44
PID 5956 wrote to memory of 6048	5956	ismhasrv.exe	44
PID 5956 wrote to memory of 6048	5956	ismhasrv.exe	44
PID 6048 wrote to memory of 6108	6048	ismhasrv.exe	45
PID 6048 wrote to memory of 6108	6048	ismhasrv.exe	45
PID 6048 wrote to memory of 6108	6048	ismhasrv.exe	45
PID 6048 wrote to memory of 6108	6048	ismhasrv.exe	45
PID 6048 wrote to memory of 6128	6048	ismhasrv.exe	47
PID 6048 wrote to memory of 6128	6048	ismhasrv.exe	47
PID 6048 wrote to memory of 6128	6048	ismhasrv.exe	47
PID 6048 wrote to memory of 6128	6048	ismhasrv.exe	47
PID 6128 wrote to memory of 2908	6128	ismhasrv.exe	48
PID 6128 wrote to memory of 2908	6128	ismhasrv.exe	48
PID 6128 wrote to memory of 2908	6128	ismhasrv.exe	48
PID 6128 wrote to memory of 2908	6128	ismhasrv.exe	48
PID 6128 wrote to memory of 2216	6128	ismhasrv.exe	50
PID 6128 wrote to memory of 2216	6128	ismhasrv.exe	50
PID 6128 wrote to memory of 2216	6128	ismhasrv.exe	50
PID 6128 wrote to memory of 2216	6128	ismhasrv.exe	50
PID 2216 wrote to memory of 4652	2216	ismhasrv.exe	51
PID 2216 wrote to memory of 4652	2216	ismhasrv.exe	51
PID 2216 wrote to memory of 4652	2216	ismhasrv.exe	51
PID 2216 wrote to memory of 4652	2216	ismhasrv.exe	51
PID 2216 wrote to memory of 5744	2216	ismhasrv.exe	53
PID 2216 wrote to memory of 5744	2216	ismhasrv.exe	53
PID 2216 wrote to memory of 5744	2216	ismhasrv.exe	53
PID 2216 wrote to memory of 5744	2216	ismhasrv.exe	53

C:\Users\Admin\AppData\Local\Temp\256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\256365b97e98c59d72bd2efead89ca07_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259488272.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2076
- C:\Windows\SysWOW64\ismhasrv.exe
  C:\Windows\system32\ismhasrv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259488459.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5768
- - C:\Windows\SysWOW64\ismhasrv.exe
    C:\Windows\system32\ismhasrv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259488475.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:5848
  - - C:\Windows\SysWOW64\ismhasrv.exe
      C:\Windows\system32\ismhasrv.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5888
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259488506.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
    - - C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5956
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259488521.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
      - C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259488631.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6128
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259488646.bat
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259489333.bat
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259489442.bat
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259490191.bat
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259491189.bat
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259492031.bat
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259492250.bat
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259492796.bat
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        15⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259492905.bat
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        16⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259496836.bat
        17⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        17⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259498256.bat
        18⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        18⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259501313.bat
        19⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        19⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259503622.bat
        20⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        20⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259503669.bat
        21⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        21⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259505401.bat
        22⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        22⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259508349.bat
        23⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        23⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259513684.bat
        24⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        24⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259514917.bat
        25⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        25⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259515322.bat
        26⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        26⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259515510.bat
        27⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        27⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259515837.bat
        28⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        28⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259517569.bat
        29⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        29⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259574852.bat
        30⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        30⤵
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259575258.bat
        31⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        31⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259576600.bat
        32⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        32⤵
        
        PID:184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259577442.bat
        33⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        33⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259578425.bat
        34⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        34⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259578877.bat
        35⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        35⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259580531.bat
        36⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        36⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259581982.bat
        37⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        37⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259583245.bat
        38⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        38⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259586911.bat
        39⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        39⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259587535.bat
        40⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        40⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259592730.bat
        41⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        41⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259594618.bat
        42⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        42⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259597223.bat
        43⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        43⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259599734.bat
        44⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        44⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259600499.bat
        45⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        45⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259600967.bat
        46⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\ismhasrv.exe
        
        C:\Windows\system32\ismhasrv.exe
        46⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259605616.bat
        47⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259629453.bat
        40⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259622448.bat
        39⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259622713.bat
        38⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259620982.bat
        37⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259619547.bat
        36⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259617893.bat
        35⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259612839.bat
        34⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259614851.bat
        33⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259610889.bat
        32⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259609937.bat
        31⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259605850.bat
        30⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259605366.bat
        29⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259553277.bat
        28⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259552139.bat
        27⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259551312.bat
        26⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259552778.bat
        25⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259551312.bat
        24⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259552326.bat
        23⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259544900.bat
        22⤵
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259539128.bat
        21⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259539175.bat
        20⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259539128.bat
        19⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259539705.bat
        18⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259537053.bat
        17⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259536148.bat
        16⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259530985.bat
        15⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259530408.bat
        14⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259530907.bat
        13⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259530548.bat
        12⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259525728.bat
        11⤵
        
        PID:300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259521937.bat
        10⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259523996.bat
        9⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259520751.bat
        8⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259521391.bat
        7⤵
        
        PID:1068
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259519269.bat
        6⤵
        
        PID:9496
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259520626.bat
        5⤵
        
        PID:5660
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259519254.bat
      4⤵
      PID:9460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259519004.bat
  2⤵
  PID:9396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFD259488272.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD259519004.bat

Filesize
225B

MD5
d5b37baf816785935084ad248909b982

SHA1
47a76c684c97d8b42e946f69d85b5346c9cbd95a

SHA256
ee3a55b0837255674e0f58b2482a662cca247ba31bb894e10b5f0e13104e3829

SHA512
2f5eca285d9a3df8e28e4fbf73ef49964005b714dd4f98520ec0dd1aa4c7f15bd6647798d554d87be5d995e6fec689de5d0e1003f5f34fa58237d35da104fe53

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD259519269.bat

Filesize
121B

MD5
4e164f1b794082ae540793b321a36d87

SHA1
7744be4575b5329c72940a9b447796c1b03b8da2

SHA256
26506e8c10a7216246f3945aa60eadde199c367172ce3027a9f10061130f179f

SHA512
b07b18a6c120ce90f81941de77796b688089d886f7ab4c9cd8cbf3de2f9172c45faba871f27ac21887eb44c15646dabca1d2fee76619f621da3029243b5bf1e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD259520626.bat

Filesize
242B

MD5
5736ed67bb27be7be1b60aa8c742b231

SHA1
230ef2ca70cdb2f0604d2fba6a81b8d4d80d5258

SHA256
6680a990093172087f3a14a33de48d24760291fd818cd1bd8175bfd64cb0b544

SHA512
ff5d7fc7d3ba3b68e798ed27c0d71498de892915b33c4e399c7fad1e9b0226776640de46006fd1ad8a53f5d3f16a818110a9dfe147d95f80bd4530d6c490c262

Download Submit
C:\Windows\SysWOW64\ismhasrv.exe

Filesize
17KB

MD5
256365b97e98c59d72bd2efead89ca07

SHA1
804568fc8f1e32ae75fd696f0864330da3980e51

SHA256
df0b3adf6714eb2b01a66fc26d3ae9361f23765fded3f76e64b1dc32ffaf3fa8

SHA512
0d97661f61ff56bd9dd3a16945a4de086c2dda19ef937adc63c41642f3ce25a274ee71a7971a917db3c82ac406c62e759fbe18acdd5eed450f67c8343be53767

Download Submit
C:\Windows\SysWOW64\mnmhfsrv.dll

Filesize
525KB

MD5
f430776120e700509977d92aa7b1af5f

SHA1
e0c98fadfeaa73e3765c932c2858cc6cc297d604

SHA256
542a4fd9c1ca45b1b671f35f24f161d1e75b3ec55e1228dba929d91224d64f6e

SHA512
d25482d75815eaa06c92863586dda9c45012005b1c4d85aa46f0210af0da51d25ca25f0b85de2aeb200b23ce4be25a74c067edf33cf801bb330a51b815d842d8

Download Submit
C:\Windows\SysWOW64\mnmhfsrv.dll

Filesize
525KB

MD5
85bf3bc9f0e78c0c361ab65714d1c616

SHA1
9bcea994fb181620c946df43cf1d3092c77a2d8f

SHA256
b7c2f45376cff1712f7ce849e7c9f926eb8db879be285eeed9e3e9a3c358ac4d

SHA512
2c012c922def88968e0a72710a39782f831d410370e0843af3fac922a90a36fbaf5a3e9dd42c753c9539880b9f9ed70015576f65e43e64384682e6cbf7f5cd5d

Download Submit
C:\Windows\SysWOW64\smmhbsrv.sys

Filesize
520B

MD5
a16e7567722c205960ab4ba15c52a8a6

SHA1
0aa16f8e10322c6825b676f0d24b413b93aeb366

SHA256
dc552456b61d7ec47f4bc789aae1c2bd9784d6b7c6c72296e07fd4ea49af5577

SHA512
e94cd164902ee4193f386b461d45d94826de3773ef1cf465257a7c0ce057cc37bd12c73f08f8e266184a72573b2dc221ef9d395bdf8bb8093b3cc8240107387c

Download Submit
memory/184-21747-0x0000000000290000-0x00000000002AB000-memory.dmp

Filesize
108KB

Download
memory/184-21746-0x0000000000290000-0x00000000002AB000-memory.dmp

Filesize
108KB

Download
memory/184-18698-0x0000000000290000-0x00000000002AB000-memory.dmp

Filesize
108KB

Download
memory/184-18699-0x0000000000290000-0x00000000002AB000-memory.dmp

Filesize
108KB

Download
memory/320-16658-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/320-20191-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/320-16657-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/320-15641-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1724-26836-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/1724-28869-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/2156-5289-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2156-6306-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/2156-8341-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/2176-24803-0x0000000000280000-0x000000000029B000-memory.dmp

Filesize
108KB

Download
memory/2176-22767-0x0000000000280000-0x000000000029B000-memory.dmp

Filesize
108KB

Download
memory/2216-2134-0x0000000000420000-0x000000000043B000-memory.dmp

Filesize
108KB

Download
memory/2464-2138-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/2464-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2464-1051-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/2464-2135-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2464-1052-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/3368-7385-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/3368-7384-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/3368-9358-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/3368-9359-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/3520-11392-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/3520-11391-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/3528-28867-0x00000000003B0000-0x00000000003CB000-memory.dmp

Filesize
108KB

Download
memory/3528-28868-0x00000000003B0000-0x00000000003CB000-memory.dmp

Filesize
108KB

Download
memory/3824-15639-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/3824-18700-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/3824-15640-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/3824-19709-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/3968-21750-0x00000000001F0000-0x000000000020B000-memory.dmp

Filesize
108KB

Download
memory/3968-19711-0x00000000001F0000-0x000000000020B000-memory.dmp

Filesize
108KB

Download
memory/3968-22329-0x00000000001F0000-0x000000000020B000-memory.dmp

Filesize
108KB

Download
memory/3968-19710-0x00000000001F0000-0x000000000020B000-memory.dmp

Filesize
108KB

Download
memory/4464-5278-0x0000000000270000-0x000000000028B000-memory.dmp

Filesize
108KB

Download
memory/4464-7383-0x0000000000270000-0x000000000028B000-memory.dmp

Filesize
108KB

Download
memory/4500-29885-0x0000000000270000-0x000000000028B000-memory.dmp

Filesize
108KB

Download
memory/4640-21749-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/4640-23785-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/4640-21748-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/4644-2215-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4644-3244-0x0000000000420000-0x000000000043B000-memory.dmp

Filesize
108KB

Download
memory/4644-5279-0x0000000000420000-0x000000000043B000-memory.dmp

Filesize
108KB

Download
memory/4664-2224-0x0000000000280000-0x000000000029B000-memory.dmp

Filesize
108KB

Download
memory/4948-2211-0x0000000000230000-0x000000000024B000-memory.dmp

Filesize
108KB

Download
memory/4948-2212-0x0000000000230000-0x000000000024B000-memory.dmp

Filesize
108KB

Download
memory/4948-2200-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4948-4262-0x0000000000230000-0x000000000024B000-memory.dmp

Filesize
108KB

Download
memory/5096-3245-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/5096-5280-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/5244-9357-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/5244-13423-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/5244-13424-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/5244-9360-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/5352-13425-0x00000000002E0000-0x00000000002FB000-memory.dmp

Filesize
108KB

Download
memory/5584-5288-0x0000000000360000-0x000000000037B000-memory.dmp

Filesize
108KB

Download
memory/5584-7642-0x0000000000360000-0x000000000037B000-memory.dmp

Filesize
108KB

Download
memory/5704-1053-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5704-2139-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5744-2141-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5744-2198-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5744-2199-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5744-2140-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5800-1074-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5800-1075-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5800-2144-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5800-2143-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5920-2213-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5920-2214-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5920-2165-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5924-20729-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5924-22768-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5924-20728-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5924-23111-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/5956-1081-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/5956-2166-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/6048-2177-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/6048-2178-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/6128-2179-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/6128-2181-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/6128-1105-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/6128-1104-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/6208-6305-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/6208-4261-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/6360-30901-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/7932-26494-0x00000000001B0000-0x00000000001CB000-memory.dmp

Filesize
108KB

Download
memory/7932-24802-0x00000000001B0000-0x00000000001CB000-memory.dmp

Filesize
108KB

Download
memory/8064-20730-0x0000000001F40000-0x0000000001F5B000-memory.dmp

Filesize
108KB

Download
memory/8064-17674-0x0000000001F40000-0x0000000001F5B000-memory.dmp

Filesize
108KB

Download
memory/8728-14623-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/8728-17675-0x0000000000260000-0x000000000027B000-memory.dmp

Filesize
108KB

Download
memory/9868-25819-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/9868-23786-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download