orcus | 696edfb0ae8b67205e48937ef8bcb54f02e46d94933f491d3e9c440d3e10f4da

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exe
Size

4.0MB
MD5

fd0adf2d624744c1d5bd260f3f74e70c
SHA1

4a8ada06c927a7c02895d278f4144069933b4b16
SHA256

696edfb0ae8b67205e48937ef8bcb54f02e46d94933f491d3e9c440d3e10f4da
SHA512

800bbaef8df7596bc35c74ce8eb91852ed9ed893741417e43a8f3b51f284f4c4a53b81fd19b08284a245c9d5756c8601259a2c20530302236c70e52188785108
SSDEEP

98304:/viz/27qWGq/TzuqCDl2Ptao7jveMGDL+DJPrONg:/viq75/TzufceP2KNg

Score

10^/10

orcus discovery persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

127.0.0.1:1111

Mutex

bd2c55809d1743b78dec11ee665f95e8

Attributes

autostart_method
Registry
enable_keylogger
true
install_path
%programfiles%\ORK\ORK_AntiMalware.exe
reconnect_delay
10000
registry_keyname
ORK
taskscheduler_taskname
ORK
watchdog_path
AppData\ORK_Watchdog.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe	family_orcus

Orcurs Rat Executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe	orcus
behavioral2/memory/2728-102-0x0000000000C90000-0x0000000000D7C000-memory.dmp	orcus

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CDS.execrypted.exeORK_AntiMalware.exeORK_Watchdog.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	CDS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	crypted.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	ORK_AntiMalware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	ORK_Watchdog.exe

Executes dropped EXE 8 IoCs

Processes:

CDS.execrypted.exeWindowsInput.exeWindowsInput.exeORK_AntiMalware.exeORK_AntiMalware.exeORK_Watchdog.exeORK_Watchdog.exe

pid	process
916	CDS.exe
4364	crypted.exe
3380	WindowsInput.exe
3216	WindowsInput.exe
2728	ORK_AntiMalware.exe
2164	ORK_AntiMalware.exe
4200	ORK_Watchdog.exe
3972	ORK_Watchdog.exe

Loads dropped DLL 1 IoCs

Processes:

CDS.exe

pid process

916 CDS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exeORK_AntiMalware.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ORK = "\"C:\\Program Files\\ORK\\ORK_AntiMalware.exe\""	ORK_AntiMalware.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

crypted.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini crypted.exe
File opened for modification C:\Windows\assembly\Desktop.ini crypted.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	crypted.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	crypted.exe

Drops file in System32 directory 3 IoCs

Processes:

crypted.exeWindowsInput.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WindowsInput.exe	crypted.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	crypted.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Program Files directory 3 IoCs

Processes:

crypted.exe

description	ioc	process
File created	C:\Program Files\ORK\ORK_AntiMalware.exe	crypted.exe
File opened for modification	C:\Program Files\ORK\ORK_AntiMalware.exe	crypted.exe
File created	C:\Program Files\ORK\ORK_AntiMalware.exe.config	crypted.exe

Drops file in Windows directory 3 IoCs

Processes:

crypted.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	crypted.exe
File created	C:\Windows\assembly\Desktop.ini	crypted.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	crypted.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ORK_Watchdog.exeORK_Watchdog.exefd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exeCDS.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ORK_Watchdog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ORK_Watchdog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CDS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ORK_AntiMalware.exeORK_Watchdog.exe

pid	process
2728	ORK_AntiMalware.exe
2728	ORK_AntiMalware.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
3972	ORK_Watchdog.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe
2728	ORK_AntiMalware.exe
3972	ORK_Watchdog.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

AUDIODG.EXEORK_AntiMalware.exeORK_Watchdog.exeORK_Watchdog.exe

description	pid	process
Token: 33	5080	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5080	AUDIODG.EXE
Token: SeDebugPrivilege	2728	ORK_AntiMalware.exe
Token: SeDebugPrivilege	4200	ORK_Watchdog.exe
Token: SeDebugPrivilege	3972	ORK_Watchdog.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ORK_AntiMalware.exe

pid process

2728 ORK_AntiMalware.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

ORK_AntiMalware.exe

pid process

2728 ORK_AntiMalware.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

CDS.execrypted.execsc.execvtres.exeORK_AntiMalware.exeORK_Watchdog.exeORK_Watchdog.exe

pid	process
916	CDS.exe
916	CDS.exe
4364	crypted.exe
3316	csc.exe
4652	cvtres.exe
2728	ORK_AntiMalware.exe
2728	ORK_AntiMalware.exe
4200	ORK_Watchdog.exe
3972	ORK_Watchdog.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exeCDS.execrypted.execsc.exeORK_AntiMalware.exeORK_Watchdog.exe

description	pid	process	target process
PID 1492 wrote to memory of 916	1492	fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exe	CDS.exe
PID 1492 wrote to memory of 916	1492	fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exe	CDS.exe
PID 1492 wrote to memory of 916	1492	fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exe	CDS.exe
PID 916 wrote to memory of 4364	916	CDS.exe	crypted.exe
PID 916 wrote to memory of 4364	916	CDS.exe	crypted.exe
PID 4364 wrote to memory of 3316	4364	crypted.exe	csc.exe
PID 4364 wrote to memory of 3316	4364	crypted.exe	csc.exe
PID 3316 wrote to memory of 4652	3316	csc.exe	cvtres.exe
PID 3316 wrote to memory of 4652	3316	csc.exe	cvtres.exe
PID 4364 wrote to memory of 3380	4364	crypted.exe	WindowsInput.exe
PID 4364 wrote to memory of 3380	4364	crypted.exe	WindowsInput.exe
PID 4364 wrote to memory of 2728	4364	crypted.exe	ORK_AntiMalware.exe
PID 4364 wrote to memory of 2728	4364	crypted.exe	ORK_AntiMalware.exe
PID 2728 wrote to memory of 4200	2728	ORK_AntiMalware.exe	ORK_Watchdog.exe
PID 2728 wrote to memory of 4200	2728	ORK_AntiMalware.exe	ORK_Watchdog.exe
PID 2728 wrote to memory of 4200	2728	ORK_AntiMalware.exe	ORK_Watchdog.exe
PID 4200 wrote to memory of 3972	4200	ORK_Watchdog.exe	ORK_Watchdog.exe
PID 4200 wrote to memory of 3972	4200	ORK_Watchdog.exe	ORK_Watchdog.exe
PID 4200 wrote to memory of 3972	4200	ORK_Watchdog.exe	ORK_Watchdog.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd0adf2d624744c1d5bd260f3f74e70c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v-6kis6k.cmdline"
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3316
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92DB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC92DA.tmp"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4652
  - - C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe" --install
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:3380
  - - C:\Program Files\ORK\ORK_AntiMalware.exe
      "C:\Program Files\ORK\ORK_AntiMalware.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Users\Admin\AppData\Roaming\ORK_Watchdog.exe
        
        "C:\Users\Admin\AppData\Roaming\ORK_Watchdog.exe" /launchSelfAndExit "C:\Program Files\ORK\ORK_AntiMalware.exe" 2728
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4200
      - C:\Users\Admin\AppData\Roaming\ORK_Watchdog.exe
        
        "C:\Users\Admin\AppData\Roaming\ORK_Watchdog.exe" /watchProcess "C:\Program Files\ORK\ORK_AntiMalware.exe" 2728
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x310
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:3216

C:\Program Files\ORK\ORK_AntiMalware.exe
"C:\Program Files\ORK\ORK_AntiMalware.exe"
1⤵
- Executes dropped EXE
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORK_Watchdog.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.png

Filesize
2KB

MD5
340b294efc691d1b20c64175d565ebc7

SHA1
81cb9649bd1c9a62ae79e781818fc24d15c29ce7

SHA256
72566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9

SHA512
1395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cdd

Filesize
13KB

MD5
3e7ecaeb51c2812d13b07ec852d74aaf

SHA1
e9bdab93596ffb0f7f8c65243c579180939acb26

SHA256
e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96

SHA512
635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe

Filesize
6.1MB

MD5
424bf196deaeb4ddcafb78e137fa560a

SHA1
007738e9486c904a3115daa6e8ba2ee692af58c8

SHA256
0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

SHA512
a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.dat

Filesize
921KB

MD5
611c12d0fb2b60eac4aa11bfdf55a1cd

SHA1
606744fff4babfea5d6b6cf7a85931df3d66c20f

SHA256
f6e2c6c9d660c6ac0072a1daa6dab6f8e631fc73b361de617bd4756af9ad3bb1

SHA512
d7f24f1c5ae342c9cafe478fd7416d57cad373b9299b094c058b0e5bf93bc1c2262cd7b81157f2ea372a7475211cc9e9901ebef8658ac25538415b0bee5fbf2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe

Filesize
921KB

MD5
78e11ecb488d9b6e49efd841d07d9824

SHA1
ef06138044e8b7a664fd00a74243020d2ecacb86

SHA256
e3671a66f965126a88ddbfd286b5fa6ee74c596b245b689e8c94dbf7ed2c8808

SHA512
36ca6f5382cdae2e72647374ca4ee29631fd2519761e997f0ef0ba24bd46ef6efacc3dd454b0c1a7c94f12b364e588d504b184dd8fc665d01bd3c00b307fc13f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settings

Filesize
5B

MD5
68934a3e9455fa72420237eb05902327

SHA1
7cb6efb98ba5972a9b5090dc2e517fe14d12cb04

SHA256
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

SHA512
719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll

Filesize
322KB

MD5
c3256800dce47c14acc83ccca4c3e2ac

SHA1
9d126818c66991dbc3813a65eddb88bbcf77f30a

SHA256
f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

SHA512
6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES92DB.tmp

Filesize
1KB

MD5
e2ef52913e3f5afd31e4bb358cd32767

SHA1
97b82d4a18f79572ada374421fe756d918320d17

SHA256
8a7a64e88580e90c1ed9b79ef69a7b83d4ef98342f924ec78d38048816691d16

SHA512
5942038bc75c84b5b5b1b66188dfa819bc0dcaf2df500b5e6cea8e3fa3227a9e693c9b37401fc6a7c8fbbf560b7ea2e3ba680bc42a7d0d2427186a5a07b0ae59

Download Submit
C:\Users\Admin\AppData\Local\Temp\v-6kis6k.dll

Filesize
76KB

MD5
126505ef2be7f87dc89237504ff9f2a9

SHA1
a96c0fed5c9bca7688440199886574e5b7b551ee

SHA256
b3c30ff0d0499632d194b87b148ed0d18fce1ce1f6b177909da4bde8bfdff028

SHA512
436d6829050843dcdde5230dfa6b9cf06f38f8579749e5d6e7040251ec06591c17dfb1ede783a61b321d77d5d32a074c24c772cc32c76fce1bdaa90549e31d7c

Download Submit
C:\Users\Admin\AppData\Roaming\ORK_Watchdog.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
e6fcf516d8ed8d0d4427f86e08d0d435

SHA1
c7691731583ab7890086635cb7f3e4c22ca5e409

SHA256
8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

SHA512
c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC92DA.tmp

Filesize
676B

MD5
c14397b4fe070e772f5154a3ddbba124

SHA1
4d3742176f2c495a35b345cdf837fbb07c2d51d6

SHA256
2b1ceded04e3169f4f6cede01eca502a837bd1c918f706cb2f98a7f69247d7f3

SHA512
ccc548e830af5da5c003456b99de069b092bac8cf8ca5808a5478dcdaf1cff84fcf30531deac8eb46d7a167829bf77ef4dc657bab5642e743a214e333732d70f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v-6kis6k.0.cs

Filesize
208KB

MD5
506cbf32becacad4e877c0cbcd42f36d

SHA1
5c55d79378d5ec7c1a2a7b8d54c0667424d8115a

SHA256
99cb6338c96c9d30a0cbdaf821c76592e8a3c0ad33c9f1c3b10b3c1921f3822b

SHA512
aebc170c171d8614b5ea0a7467b4441f9e45d3e402f4bee27467e1dc331720f35baaa865970ea12e6e67179aee44e4784eaee9ba028a7ca26b7f53dbe84daf76

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v-6kis6k.cmdline

Filesize
349B

MD5
3cda8f800cd0c0650e337954f2b9451a

SHA1
985dcc38bb841506e34a356ad4cc01ca4c7919c8

SHA256
439b6a5d7aa3739e85168963726b2a4aedb36d12e4ef1d8a5bbf589250168b5d

SHA512
6ddb9ed352584ec4b6237d7c41363ac52b0e34872f769b09f4b4378d79f5c669e098914ad93fbf0ef8999bdd6d8ae9eac30400bf69e2451d6d2d9399e850c7a1

Download Submit
memory/2728-108-0x000000001C020000-0x000000001C030000-memory.dmp

Filesize
64KB

Download
memory/2728-104-0x000000001BA30000-0x000000001BA7E000-memory.dmp

Filesize
312KB

Download
memory/2728-103-0x0000000002EA0000-0x0000000002EB2000-memory.dmp

Filesize
72KB

Download
memory/2728-102-0x0000000000C90000-0x0000000000D7C000-memory.dmp

Filesize
944KB

Download
memory/2728-106-0x000000001BF00000-0x000000001BF18000-memory.dmp

Filesize
96KB

Download
memory/2728-107-0x000000001C270000-0x000000001C432000-memory.dmp

Filesize
1.8MB

Download
memory/3216-85-0x000000001A960000-0x000000001AA6A000-memory.dmp

Filesize
1.0MB

Download
memory/3380-80-0x0000000001630000-0x000000000166C000-memory.dmp

Filesize
240KB

Download
memory/3380-79-0x00000000013B0000-0x00000000013C2000-memory.dmp

Filesize
72KB

Download
memory/3380-78-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download
memory/4200-122-0x0000000000A10000-0x0000000000A18000-memory.dmp

Filesize
32KB

Download
memory/4364-64-0x000000001D120000-0x000000001D140000-memory.dmp

Filesize
128KB

Download
memory/4364-63-0x0000000002E30000-0x0000000002E38000-memory.dmp

Filesize
32KB

Download
memory/4364-62-0x00000000030C0000-0x00000000030D2000-memory.dmp

Filesize
72KB

Download
memory/4364-60-0x000000001D0E0000-0x000000001D0F6000-memory.dmp

Filesize
88KB

Download
memory/4364-47-0x000000001CA40000-0x000000001CADC000-memory.dmp

Filesize
624KB

Download
memory/4364-46-0x000000001C4D0000-0x000000001C99E000-memory.dmp

Filesize
4.8MB

Download
memory/4364-45-0x000000001BFC0000-0x000000001BFCE000-memory.dmp

Filesize
56KB

Download
memory/4364-42-0x000000001BDA0000-0x000000001BDFC000-memory.dmp

Filesize
368KB

Download