orcus | aaf544958a6ea995d6178f848ec7e52a63d58b2b5374611295c4b52f05140417

Analysis

max time kernel
173s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlitzedGrabberV12exe.exe
Size 44.1MB
Sample240107-x2bzhsccen
SHA256 aaf544958a6ea995d6178f848ec7e52a63d58b2b5374611295c4b52f05140417
MD5 afefebe0065d4402d31ebc67847a2e76
SHA1 c1ff5a5297df7679f69a4f1d91132b41a24f6334
SHA512 40465f41e358e17dda8c89c25f7cbed806358be56a1f495ced38ba5be1fa07cf00f46c5d56e0142b02152f338c5390633e0080bf0c03bef9afe84b7a57cff2c8
SSDEEP 49152:KUAHP06/eyShf+okdWtRAOk3HQ7JTDCgV4L6uzxGiWaUKU:WmBf2dWtnGcDnMjFWxK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

orcus agilenet persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

209.25.141.181:40489

Mutex

248d60d8a7114264bce951ca45664b1d

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programdata%\Chrome\chromedriver.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
winlogon.exe
watchdog_path
AppData\svchost.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 6 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023107-19.dat	family_orcus
behavioral2/files/0x0008000000023107-24.dat	family_orcus
behavioral2/files/0x0008000000023107-25.dat	family_orcus
behavioral2/files/0x00070000000231fa-333.dat	family_orcus
behavioral2/files/0x00070000000231fa-337.dat	family_orcus
behavioral2/files/0x00070000000231fa-693.dat	family_orcus

Orcurs Rat Executable 7 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023107-19.dat	orcus
behavioral2/files/0x0008000000023107-24.dat	orcus
behavioral2/files/0x0008000000023107-25.dat	orcus
behavioral2/files/0x00070000000231fa-333.dat	orcus
behavioral2/files/0x00070000000231fa-337.dat	orcus
behavioral2/memory/3216-342-0x0000000000F10000-0x000000000100C000-memory.dmp	orcus
behavioral2/files/0x00070000000231fa-693.dat	orcus

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	WindowsInput.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	UnityCrashHandlerV2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	chromedriver.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 9 IoCs

pid	Process
2184	mxfix.EXE
3888	UnityCrashHandlerV2.exe
3476	BlitzedGrabberV12.exe
916	WindowsInput.exe
1680	WindowsInput.exe
3216	chromedriver.exe
3920	svchost.exe
3088	svchost.exe
1812	chromedriver.exe

Loads dropped DLL 1 IoCs

pid	Process
3476	BlitzedGrabberV12.exe

Obfuscated with Agile.Net obfuscator 33 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/3476-71-0x0000000005440000-0x0000000005632000-memory.dmp	agile_net
behavioral2/memory/3476-81-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-82-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-84-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-91-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-93-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-88-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-97-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-95-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-99-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-101-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-107-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-105-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-109-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-114-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-117-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-122-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-132-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-136-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-140-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-143-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-145-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-147-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-149-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-151-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-156-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-158-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-153-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-128-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-124-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-120-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-112-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net
behavioral2/memory/3476-103-0x0000000005440000-0x000000000562E000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	mxfix.EXE

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.exe	UnityCrashHandlerV2.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	UnityCrashHandlerV2.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe
File opened for modification	C:\Windows\assembly	UnityCrashHandlerV2.exe
File created	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4132	powershell.exe
4132	powershell.exe
3088	svchost.exe
3088	svchost.exe
3088	svchost.exe
3088	svchost.exe
3216	chromedriver.exe
3216	chromedriver.exe
3216	chromedriver.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe
3088	svchost.exe
3216	chromedriver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	3216	chromedriver.exe
Token: SeDebugPrivilege	3920	svchost.exe
Token: SeDebugPrivilege	3088	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3216	chromedriver.exe
3476	BlitzedGrabberV12.exe
3476	BlitzedGrabberV12.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2184	1680	WindowsInput.exe	90
PID 1680 wrote to memory of 2184	1680	WindowsInput.exe	90
PID 2184 wrote to memory of 4132	2184	mxfix.EXE	91
PID 2184 wrote to memory of 4132	2184	mxfix.EXE	91
PID 1680 wrote to memory of 3888	1680	WindowsInput.exe	92
PID 1680 wrote to memory of 3888	1680	WindowsInput.exe	92
PID 1680 wrote to memory of 3476	1680	WindowsInput.exe	94
PID 1680 wrote to memory of 3476	1680	WindowsInput.exe	94
PID 1680 wrote to memory of 3476	1680	WindowsInput.exe	94
PID 3888 wrote to memory of 1528	3888	UnityCrashHandlerV2.exe	95
PID 3888 wrote to memory of 1528	3888	UnityCrashHandlerV2.exe	95
PID 1528 wrote to memory of 3932	1528	csc.exe	98
PID 1528 wrote to memory of 3932	1528	csc.exe	98
PID 3888 wrote to memory of 916	3888	UnityCrashHandlerV2.exe	99
PID 3888 wrote to memory of 916	3888	UnityCrashHandlerV2.exe	99
PID 3888 wrote to memory of 3216	3888	UnityCrashHandlerV2.exe	102
PID 3888 wrote to memory of 3216	3888	UnityCrashHandlerV2.exe	102
PID 3216 wrote to memory of 3920	3216	chromedriver.exe	104
PID 3216 wrote to memory of 3920	3216	chromedriver.exe	104
PID 3216 wrote to memory of 3920	3216	chromedriver.exe	104
PID 3920 wrote to memory of 3088	3920	svchost.exe	105
PID 3920 wrote to memory of 3088	3920	svchost.exe	105
PID 3920 wrote to memory of 3088	3920	svchost.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12exe.exe
"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12exe.exe"
1⤵
PID:1680
- C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
  "C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\esu4opsq.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3E3.tmp"
      4⤵
      PID:3932
- - C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe" --install
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:916
- - C:\ProgramData\Chrome\chromedriver.exe
    "C:\ProgramData\Chrome\chromedriver.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\ProgramData\Chrome\chromedriver.exe" 3216 /protectFile
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3920
    - - C:\Users\Admin\AppData\Roaming\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\ProgramData\Chrome\chromedriver.exe" 3216 "/protectFile"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
- C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
  "C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3476

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680

C:\ProgramData\Chrome\chromedriver.exe
C:\ProgramData\Chrome\chromedriver.exe
1⤵
- Executes dropped EXE
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromedriver.exe

Path C:\ProgramData\Chrome\chromedriver.exe
Size 23KB
SHA256 876869c0778f5c58eab817a9a234c698a5dcd0cb2c3176535f1b25cedab7512a
MD5 60985623a24c734755c117dedd01aa1d
SHA1 31d6b3f99f0bba22554633cd96609267d316c258
SHA512 67de7f0a1b7dd891958a084ad308fe3a1066d379eb0d4f428a20ef49302312e441062ef5f4c5fbab008e09cd33f0781cd43b026c7942d553b5e6f1bdbf57079c
SSDEEP 384:m3OoR9qfsNYuGDC5GT7navKXQNn0ciQDXFtOlTFhjJUzQh08ykMNeB:m3OqR2uGDAGTraAQN06j+lTfJhNNM0B
MD5 SHA1 SHA512 SSDEEP

Submit Download

chromedriver.exe

Path C:\ProgramData\Chrome\chromedriver.exe
Size 82KB
SHA256 4674b8846f6fa613e03f83a69e2c25c9c72cfe7c920507a97f21d27c9a792077
MD5 479f009c2edd0197f6378b4cbce03862
SHA1 e71c5ee955646b84063db6819847737baaa2373d
SHA512 183dffcec4d82966a0fe41dfd308d16ea4cc5c57af28cf69e70034628eb9920ca447a5d6feee93a3504321cc5bea498ec70d2ef80180929c59da871c81a42190
SSDEEP 1536:m3Ommra5CgCf3M0go7qQ2kDGYv1643GrkJNE69+XWO4GIz9HY1ZEMBDjQOPYsHvf:m+mmrZDM0F643GrkJNEsfB++/TY3cW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chromedriver.exe

Path C:\ProgramData\Chrome\chromedriver.exe
Size 175KB
SHA256 cb1b6f5176c824a271a1348cda507428b8bc0adf0ad228b2566ede150b5ea945
MD5 862922e84b377ae0544720d38a731088
SHA1 aa43bb7df258e80b8ff16674406d5ca1e7613df0
SHA512 0343a4c9d969bc0c8ec70394644356f73259d028227ba1a14f79dec13d89a5763c54c6dcd6f97cbe9bf1fabf0220834094cdfd9ab0258052a1166f42be68cc07
SSDEEP 3072:m+mmrZDM0F643GrkJNEsfB++/TY3cJe5k141IsqMybm1fAKyU1:em1DMY643GrkJNDfwQjJB40Xbm1JL1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
MD5 SHA1 SHA512

Submit Download

BlitzedGrabberV12.exe

Path C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
Size 250KB
SHA256 5fbebccbe9c7bea6170abb2bbbe47e164dd42678fbd65537021561e91f0feafd
MD5 c40ba4e403b2a7e161c2dddf65ef74b4
SHA1 9afebab0ed86b0e1876c38f2034b945348aeb45e
SHA512 c3b705b2f0e2d7460b01d6bd5e9cf2479ba7bf7e6309c1fd090625b6071e1230473f34fb5db2312a829e976ffffb45e868ead54dcb1be87e9bb9faeb7255aacb
SSDEEP 6144:2xr2Xg8pTeS/tKa42F28L9xV/xL4xux6HsP2o10Wt:xiuAse+0Wt
MD5 SHA1 SHA512 SSDEEP

Submit Download

BlitzedGrabberV12.exe

Path C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
Size 62KB
SHA256 d5aafedbbdb74b7eeb9460bc378fc2ac04697ac7a7b37e7d0cf790f9ca14963d
MD5 05352082df40d1e288f6a1740e0fe6ac
SHA1 996642f6619336b559105d538aeb5b35a61ddb4f
SHA512 1924302ce6b5769acce4a478901452b54b89c44374ce58f65762442e8ae099bf17acf21f96e121aca7bdfbc5ea2766aeb8270a65a2756af5c2106c08e403a20d
SSDEEP 1536:uGTJzkxr2Xg8pTeS/tKaut2FWJcj8KCHCSH/sLZG4nT+b4afVEWrr5+:u6gxr2Xg8pTeS/tKa42FTKHCSHbGc+
MD5 SHA1 SHA512 SSDEEP

Submit Download

BlitzedGrabberV12.exe

Path C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
Size 313KB
SHA256 d2af0d1de136b609e7c517be6b382a5d0ab7c5ce3487aa8017cd3420f61158ba
MD5 d38585fe44f3f4264b5e27a27143b423
SHA1 b4ac8673626248487b38b09b4022ca39e8c9c90d
SHA512 aff200b5f5a1735e5549142c36e68ab54364d41dd955069762d97000dc14e69dd843e72def33823219ecebbf883869fcf967e1e5b906d49e778de740e7f53e16
SSDEEP 6144:2xr2Xg8pTeS/tKa42F28L9xV/xL4xux6HsP2o10WUQf/bSB/nwnA:xiuAse+0W/2Pz
MD5 SHA1 SHA512 SSDEEP

Submit Download

mxfixer.ps1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mxfixer.ps1
Size 35B
SHA256 41eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb
MD5 5d792fc7c4e2fd3eb595fce4883dcb2d
SHA1 ee2a88f769ad746f119e144bd06832cb55ef1e0f
SHA512 4b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e
MD5 SHA1 SHA512

Submit Download

RES3F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3F4.tmp
Size 1KB
SHA256 ce444ce829e3135feb68cc2fc95e5019652a5a5983fb2c36f1591546798269ed
MD5 a06b0218943aa8d150100aaebcb6117a
SHA1 632c37bf2915f37e651c702bd0c6b8763d9c92af
SHA512 d3b4a234877f5aa8de40f704b984e4d98a745e05449803928df22f6d745f180c407d752f53780a3c2e19f6fa5e5efd96055d434a280caf009bcf80bd0a058c28
MD5 SHA1 SHA512

Submit Download

UnityCrashHandlerV2.exe

Path C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
Size 819KB
SHA256 1a26f5e7bf18d84cb7da5bce5cc85dac379d1154a61e7fa4fae5c365dfb3c074
MD5 d6574b9fd9dbf745f7ab2c8b5ecfd839
SHA1 c64967edc7d79ff9aea29c073b3318f88813477b
SHA512 7b845adbf979d1b9e8effd99b9cf85265bd406d0621af8f4aa793512952e3b891ef6d41bdddf7a4eb54d39eb9654b6d08607273b735cebe2ac91c78796c12bd0
SSDEEP 12288:w43GrkJNrwiBp0Z7dG1lFlWcYT70pxnnaaoawhmx3vK9IZHw6lrZNrI0AilFEvxx:ooA4MROxnFt3S9MQQrZlI0AilFEvxHiK
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnityCrashHandlerV2.exe

Path C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
Size 509KB
SHA256 c8f42747d4e80567b2a55eeb2aab4e6cb818d208389a603a362cd4fc1c60b9ce
MD5 53ef08805f8703c67f990711c72ccf64
SHA1 50691dc4270a73f0562ebb33a0d7ed0f3a07592f
SHA512 643d1adb95a92f9180a01d1ec8dcddb8d909f81be416e6da619703b093d82964325d778ce0fc2806b31cda835d2c29075fb0583590298c2f61f461aeacf7495f
SSDEEP 12288:w43GrkJNrwiBp0Z7dG1lFlWcYT70pxnnaaoaO:ooA4MROxnFO
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnityCrashHandlerV2.exe

Path C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
Size 491KB
SHA256 47f11f63a476bfd37067b413055a4a02c44344854dabc385ef534b92f36867da
MD5 9a9714e794fb71ce3c95a6e1cb247e10
SHA1 024594c2ff638b3e140e03063448cd3c7f74a492
SHA512 963357aefc67ace4c42126d904ee3b33eb0d2a1074d159b78ffd5a84ebcd5701f500fc3f82316a5378586c196085a323a525d3c17454761198ce019598824445
SSDEEP 12288:w43GrkJNrwiBp0Z7dG1lFlWcYT70pxnnaaoo:ooA4MROxnz
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_mid5udic.gio.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mid5udic.gio.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

GunaDotNetRT.dll

Path C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dll
Size 136KB
SHA256 77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
MD5 9af5eb006bb0bab7f226272d82c896c7
SHA1 c2a5bb42a5f08f4dc821be374b700652262308f0
SHA512 7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
SSDEEP 3072:nIuwb3gn+bp4G6qepZn07UHGm2pM1g23mGpzqQ4AZ2Z34E:nIb3gn+bp45DGP923mGpzjcZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

GunaDotNetRT.dll

Path C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dll
Size 104KB
SHA256 3a73acf592e39fae894a712d02a76cb71fc875b4d171cd40b3bcec29007d346e
MD5 d2cd6cc0fef15230f84c2dc280d9c831
SHA1 da4fba977b83c5384077e0b61ccfc33105f43738
SHA512 f8a3f7f944495e9c4b9702ce03fceb02d19d0e85a8a1a7334c6d3af17890aa7315a180462a45f9fd8026e616b23c08ab7b7b34bd63f24212bdd3c2cfbe3e5ffa
SSDEEP 3072:nIuwb3gn+bp4G6qepZn07UHGm2pM1g23mGpzqW:nIb3gn+bp45DGP923mGpz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

esu4opsq.dll

Path C:\Users\Admin\AppData\Local\Temp\esu4opsq.dll
Size 76KB
SHA256 3a4f7fc32bd8cc711afa11af53f944d2773ebdee30607aa52cef571f1ee3a2bb
MD5 ec27e6e36d568380915d830417b1c36f
SHA1 1a4c36df5c3b29031d58f723c4fcb595de0911b9
SHA512 9df28454352737045343ae16dc49fe7bf652333c7334f27e86c59e472b9a70f24d04949052811a8080c7b9bd44d53a45539365d27a87b29c9e6c33ea6e851864
SSDEEP 768:JP2kLied1g3JjSaJtWTMXIpjt3+Gw0eaFFO6SNnX0KGksqGt84ESp9xXcg1vYfab:92ImARKK/VM8gfa8/QCPEmbKCsC/6f
MD5 SHA1 SHA512 SSDEEP

Submit Download

mxfix.EXE

Path C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
Size 155KB
SHA256 e18ba6573b9aa2d139ed5c30f18ac2ece3ce8287d1651db4bc632dbc816f53bd
MD5 b4ec612c441786aa614ce5f32edae475
SHA1 3a264f8daeec9b156ddb5ed576d490dd8fbd8e7d
SHA512 c6800371cdc2b571061e6e755a2c95f49dcb233c3999976f180cb7cf95fa2c62d03b52a3c497a2cd7ae46ec72eaf823db25bd291ca676724194c05966f2bce16
SSDEEP 3072:VahKyd2n31M5GWp1icKAArDZz4N9GhbkrNEkYoTze:VahOMp0yN90QE1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 9KB
SHA256 8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
MD5 913967b216326e36a08010fb70f9dba3
SHA1 7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA512 c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
SSDEEP 96:jmqLxbUsEIoD6sO4IcAh3VnRk3ieU6fsPC8+hKkBLiWTSFThPATlHNUpjbGxdRzj:jmST5dnhTgKXPCPhvBLiW+FFAoSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsInput.exe

Path C:\Windows\SysWOW64\WindowsInput.exe
Size 21KB
SHA256 8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
MD5 e6fcf516d8ed8d0d4427f86e08d0d435
SHA1 c7691731583ab7890086635cb7f3e4c22ca5e409
SHA512 c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
SSDEEP 384:v4I7s3DhDXbdCEiWByrv0/5OPovw+BdkDGIMA10qKpWn:gggDhDXxeWwDgOD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsInput.exe.config

Path C:\Windows\SysWOW64\WindowsInput.exe.config
Size 357B
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
MD5 SHA1 SHA512

Submit Download

CSC3E3.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC3E3.tmp
Size 676B
SHA256 f1918d9498fee42003a267b577bbff3cf91cc26b75a4ac0db5154a92061703d4
MD5 e8a15bb40b8b382c333220a4b80b4497
SHA1 95c1ad8d1a5d64c739180193e9c80cd4e844c806
SHA512 182de30c6238d165e36390fb1dd063089eaa5bb65e72c3129480739955ed4b29e0934ab2609b52687d89ce6d5a8c18df4cc9e694b1440b76d147beb0d73d8f29
MD5 SHA1 SHA512

Submit Download

esu4opsq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\esu4opsq.0.cs
Size 208KB
SHA256 d3844a28a64079996f31094ee4585a692bce306b7889c52824a0556fcfa7d069
MD5 0f4bacc7a4d4670dd9825c0b77562038
SHA1 24501b3416acf1f1bb73ac08d57a67b5a5368e0c
SHA512 f56425201661ffd693251db57ef7e861e5cf9bb63b1a3e259113e7de7ee2636da448b007f9818bcd6dad2b37d2897d638918e72d38009bca8a33c3002b386044
SSDEEP 6144:IxC2lRxS7tFGAzGtAWf4xC2lRxS7UL7WyLqmB5f6JrDRJT5PNPrJjNYX/Es4:SlR05FGAzGtAWfilR0oL7WyLqmB5f6Jx
MD5 SHA1 SHA512 SSDEEP

Submit Download

esu4opsq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\esu4opsq.cmdline
Size 349B
SHA256 f5ed84f4b85db9c7ab42b8b1181d47f68ad1a55c4aa5a1638dc04c70be597a74
MD5 837ee0633ef138cba72293b8d9bab709
SHA1 ae38e68d4cc0c3906c04cb07dc9f364f9ad9d39b
SHA512 dfe47d6c5388c1e1679974c073583214fb016b6c366727ec51289be4f6b129bccb789324f26587e711ad10405e671646ce3856b9cc14d8035262ab7ecf198bf9
MD5 SHA1 SHA512

Submit Download

memory/916-235-0x00007FF993670000-0x00007FF994131000-memory.dmp

Download

memory/916-217-0x0000000002450000-0x000000000248C000-memory.dmp

Download

memory/916-197-0x0000000000220000-0x000000000022C000-memory.dmp

Download

memory/916-204-0x00007FF993670000-0x00007FF994131000-memory.dmp

Download

memory/916-206-0x000000001AF70000-0x000000001AF80000-memory.dmp

Download

memory/916-209-0x00000000023F0000-0x0000000002402000-memory.dmp

Download

memory/1528-119-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

Download

memory/1680-0-0x0000000000E50000-0x0000000001094000-memory.dmp

Download

memory/1680-200-0x00007FF993CA0000-0x00007FF994761000-memory.dmp

Download

memory/1680-1134-0x00007FF993670000-0x00007FF994131000-memory.dmp

Download

memory/1680-1358-0x0000000019FE0000-0x0000000019FF0000-memory.dmp

Download

memory/1680-3-0x000000001BD60000-0x000000001BD70000-memory.dmp

Download

memory/1680-265-0x000000001ADB0000-0x000000001AEBA000-memory.dmp

Download

memory/1680-247-0x0000000019FE0000-0x0000000019FF0000-memory.dmp

Download

memory/1680-243-0x00007FF993670000-0x00007FF994131000-memory.dmp

Download

memory/1680-1-0x00007FF993CA0000-0x00007FF994761000-memory.dmp

Download

memory/1812-907-0x00007FF993670000-0x00007FF994131000-memory.dmp

Download

memory/3088-637-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/3216-1826-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

Download

memory/3216-342-0x0000000000F10000-0x000000000100C000-memory.dmp

Download

memory/3216-345-0x00007FF993670000-0x00007FF994131000-memory.dmp

Download

memory/3216-349-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

Download

memory/3216-359-0x000000001B990000-0x000000001B9A2000-memory.dmp

Download

memory/3216-362-0x000000001C860000-0x000000001C8AE000-memory.dmp

Download

memory/3216-564-0x000000001CA20000-0x000000001CA38000-memory.dmp

Download

memory/3216-566-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

Download

memory/3216-571-0x000000001CD30000-0x000000001CEF2000-memory.dmp

Download

memory/3216-573-0x000000001CB50000-0x000000001CB60000-memory.dmp

Download

memory/3216-1586-0x00007FF993670000-0x00007FF994131000-memory.dmp

Download

memory/3216-2063-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

Download

memory/3216-2298-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

Download

memory/3476-70-0x0000000004F60000-0x0000000004F6A000-memory.dmp

Download

memory/3476-91-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-140-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-143-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-145-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-147-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-149-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-151-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-156-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-61-0x0000000000400000-0x00000000005AC000-memory.dmp

Download

memory/3476-158-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-607-0x0000000071320000-0x0000000071357000-memory.dmp

Download

memory/3476-153-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-60-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/3476-575-0x0000000005240000-0x0000000005250000-memory.dmp

Download

memory/3476-132-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-122-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-117-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-114-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-109-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-105-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-107-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-101-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-99-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-95-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-128-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-97-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-124-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-120-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-88-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-112-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-93-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-103-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-136-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-84-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-79-0x0000000071320000-0x0000000071357000-memory.dmp

Download

memory/3476-80-0x0000000073630000-0x00000000736B9000-memory.dmp

Download

memory/3476-82-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-67-0x0000000005800000-0x0000000005DA4000-memory.dmp

Download

memory/3476-68-0x0000000004F80000-0x0000000005012000-memory.dmp

Download

memory/3476-81-0x0000000005440000-0x000000000562E000-memory.dmp

Download

memory/3476-71-0x0000000005440000-0x0000000005632000-memory.dmp

Download

memory/3476-69-0x0000000005240000-0x0000000005250000-memory.dmp

Download

memory/3476-347-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/3888-155-0x00000000018E0000-0x00000000018F2000-memory.dmp

Download

memory/3888-169-0x000000001D200000-0x000000001D220000-memory.dmp

Download

memory/3888-66-0x000000001CB00000-0x000000001CB9C000-memory.dmp

Download

memory/3888-65-0x00007FF9900C0000-0x00007FF990A61000-memory.dmp

Download

memory/3888-63-0x0000000001900000-0x0000000001910000-memory.dmp

Download

memory/3888-139-0x000000001D1C0000-0x000000001D1D6000-memory.dmp

Download

memory/3888-64-0x000000001C590000-0x000000001CA5E000-memory.dmp

Download

memory/3888-52-0x00007FF9900C0000-0x00007FF990A61000-memory.dmp

Download

memory/3888-54-0x000000001BEE0000-0x000000001BF3C000-memory.dmp

Download

memory/3888-59-0x000000001C0B0000-0x000000001C0BE000-memory.dmp

Download

memory/3888-340-0x00007FF9900C0000-0x00007FF990A61000-memory.dmp

Download

memory/3888-341-0x00007FF9900C0000-0x00007FF990A61000-memory.dmp

Download

memory/3888-159-0x00000000018C0000-0x00000000018C8000-memory.dmp

Download

memory/3920-610-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/3920-635-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/3920-606-0x0000000000AD0000-0x0000000000AD8000-memory.dmp

Download

memory/4132-62-0x00007FF993CA0000-0x00007FF994761000-memory.dmp

Download

memory/4132-53-0x000001DC76C60000-0x000001DC76C70000-memory.dmp

Download

memory/4132-44-0x000001DC76C60000-0x000001DC76C70000-memory.dmp

Download

memory/4132-45-0x000001DC76C60000-0x000001DC76C70000-memory.dmp

Download

memory/4132-46-0x000001DC794B0000-0x000001DC794D2000-memory.dmp

Download

memory/4132-34-0x00007FF993CA0000-0x00007FF994761000-memory.dmp

Download