orcus | e67c3d893e403f8974605d2c77bf66930c880de94dddb02dc13ce7c8d40ad700

Analysis

max time kernel
73s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xda.exe
Size

3.0MB
MD5

cf6aa82e9cb164a4ddd30a1f77db1eb7
SHA1

60790744a396419695221c39aee74672bc67fa66
SHA256

e67c3d893e403f8974605d2c77bf66930c880de94dddb02dc13ce7c8d40ad700
SHA512

e9465d2469199972ece28fde93be701e15d97bb495ee75545161ebb8712591b04867110d8632fce712295399c89338fdfe2c7c5179f597bffd8e3c679b95ae09
SSDEEP

49152:XzTEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmWrZEIN:XzTtODUKTslWp2MpbfGGilIJPypSbxE8

Score

10^/10

orcus defense_evasion discovery evasion persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

orcus

89.23.100.155:1337

Mutex

d058ef377b7f46bea0e52b669562775b

Attributes

autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/856-24-0x000000001C1E0000-0x000000001C1EA000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Orcus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Orcus.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcus main payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023ccd-229.dat	family_orcus
behavioral2/files/0x0008000000023cb7-235.dat	family_orcus

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe

Orcurs Rat Executable 3 IoCs

resource	yara_rule
behavioral2/memory/856-73-0x000000001E670000-0x000000001E970000-memory.dmp	orcus
behavioral2/files/0x0008000000023ccd-229.dat	orcus
behavioral2/files/0x0008000000023cb7-235.dat	orcus

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	OrcusWatchdog.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	xda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Orcus.exe

Executes dropped EXE 6 IoCs

pid	Process
3604	WindowsInput.exe
1672	WindowsInput.exe
3084	Orcus.exe
4492	Orcus.exe
864	OrcusWatchdog.exe
3100	OrcusWatchdog.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Orcus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Orcus = "\"C:\\Program Files\\Orcus\\Orcus.exe\""	Orcus.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xda.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	Orcus.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe	xda.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	xda.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Orcus\Orcus.exe	xda.exe
File opened for modification	C:\Program Files\Orcus\Orcus.exe	xda.exe
File created	C:\Program Files\Orcus\Orcus.exe.config	xda.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrcusWatchdog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrcusWatchdog.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1544	powershell.exe
1544	powershell.exe
3588	powershell.exe
3588	powershell.exe
3100	OrcusWatchdog.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3084	Orcus.exe
3084	Orcus.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe
3100	OrcusWatchdog.exe
3100	OrcusWatchdog.exe
3084	Orcus.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	3084	Orcus.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	864	OrcusWatchdog.exe
Token: SeDebugPrivilege	3100	OrcusWatchdog.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3084	Orcus.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3084	Orcus.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2392	856	xda.exe	87
PID 856 wrote to memory of 2392	856	xda.exe	87
PID 2392 wrote to memory of 2660	2392	csc.exe	89
PID 2392 wrote to memory of 2660	2392	csc.exe	89
PID 856 wrote to memory of 3604	856	xda.exe	90
PID 856 wrote to memory of 3604	856	xda.exe	90
PID 856 wrote to memory of 1544	856	xda.exe	94
PID 856 wrote to memory of 1544	856	xda.exe	94
PID 856 wrote to memory of 3084	856	xda.exe	106
PID 856 wrote to memory of 3084	856	xda.exe	106
PID 3084 wrote to memory of 3588	3084	Orcus.exe	108
PID 3084 wrote to memory of 3588	3084	Orcus.exe	108
PID 3084 wrote to memory of 864	3084	Orcus.exe	111
PID 3084 wrote to memory of 864	3084	Orcus.exe	111
PID 3084 wrote to memory of 864	3084	Orcus.exe	111
PID 864 wrote to memory of 3100	864	OrcusWatchdog.exe	112
PID 864 wrote to memory of 3100	864	OrcusWatchdog.exe	112
PID 864 wrote to memory of 3100	864	OrcusWatchdog.exe	112

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	Orcus.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xda.exe
"C:\Users\Admin\AppData\Local\Temp\xda.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:856
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\elrbnedq.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB48C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB48B.tmp"
    3⤵
    PID:2660
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
    "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 3084
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
      "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 3084
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3100

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:1672

C:\Program Files\Orcus\Orcus.exe
"C:\Program Files\Orcus\Orcus.exe"
1⤵
- Executes dropped EXE
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Orcus\Orcus.exe

Filesize
3.0MB

MD5
cf6aa82e9cb164a4ddd30a1f77db1eb7

SHA1
60790744a396419695221c39aee74672bc67fa66

SHA256
e67c3d893e403f8974605d2c77bf66930c880de94dddb02dc13ce7c8d40ad700

SHA512
e9465d2469199972ece28fde93be701e15d97bb495ee75545161ebb8712591b04867110d8632fce712295399c89338fdfe2c7c5179f597bffd8e3c679b95ae09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OrcusWatchdog.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\801.exe

Filesize
3.0MB

MD5
86c168112d2ca3e45d3a2c4a0ed5b261

SHA1
7f63b4b0564f3d0393b9ade80843fffe94149aa8

SHA256
fee1fee22df1dc900f56b91ab08b3360a4c2ade7a6e7a872870b70878e2ab0a5

SHA512
8da0a343b57ff59ddf2350a41d6fd583de1838d83beb7e328eba52ed1ffa9b54627cc85040e76303be9526046e269bf71a0a408e67f892da85b08cfb13605e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB48C.tmp

Filesize
1KB

MD5
2e619d3faa2748e4eb47aacd273356ba

SHA1
e36fc34185813e0f42df0e2161c36911648ed240

SHA256
c3ab3a3081811f10143a6d40508fd6657b55c23de35375f11fdfcff434712ed6

SHA512
ab3acd6755092b005956d4be44d0975784f9d31a1510fada2abcff4884f728a107b99dad0ac708a5a645f4e268d39f32b6915629629933bbea72b779d5f6acc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_titjjlnh.m4f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\elrbnedq.dll

Filesize
76KB

MD5
667ae299f9c43936f1098193511d310f

SHA1
e7ddd01ebfbdc3ed41c4591276fd4d7b0a5fd232

SHA256
a28b690216cddac3eb1ab32780b24adeaacc5c38ca896399ec34c6bfe1e1ef2b

SHA512
c21d9e42e003575ff4344d5edbe72322a42d2ccc8481fcc40e0ceec67e5375968ee17a2e3a914b0eed13d9a52a52071fb379e8008ffac0c2a5ab5546791aefd9

Download Submit
C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

Filesize
9KB

MD5
7a195b6c9de2d5cab015f649da6931a1

SHA1
89f7372dd92a90a8e13b74ee512b464412e4cf9b

SHA256
30183935449a625c2a61f6342dc3b9907028194173f2e3d594eaa3126ee316bc

SHA512
3c2aeef85b51e7f955072fba042bcedf8dd0b66ad813def58c0134355665ba56a713d58005a322561c62be5777d0adea2803da214459f362f22fe2a0dba5a1c7

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
f6285edd247fa58161be33f8cf662d31

SHA1
e2b49bca43cd0bd6cc1eee582ba58f0ed6de1470

SHA256
bc16993d1a774793044ca37eb2ce84ecbdb5c578e3c710ed82879e07dcef2fec

SHA512
6f3e6073a1dafc679da1caa4a4c9cb7cc2da79c3f81034d7b7b7b1d855fd5421cbb517a7d3f9520f49d4d3b7f9577f4f8f92486994c8b78fabff5033b390a788

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config

Filesize
349B

MD5
89817519e9e0b4e703f07e8c55247861

SHA1
4636de1f6c997a25c3190f73f46a3fd056238d78

SHA256
f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13

SHA512
b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCB48B.tmp

Filesize
676B

MD5
7e7d17593c313eff71b881ab44db91a5

SHA1
6778eb524ef5e0cf688710b2b632c5186712cd07

SHA256
1f2bcfef1431b4f9854026827fb0b0b5de2e1466157fef3b65b41ea63623d482

SHA512
29fd96008e2492b75b95d1c3fcfb3c31ed74cfa0331147a911705a381f97103011cf384fd29b9371855bc372d0616de07901431435541d761d67ac957044915c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\elrbnedq.0.cs

Filesize
208KB

MD5
aab99ca02c8fdd1d1ddd7f6160793517

SHA1
0dadd59fa2a09f241c4a8a1a44dd3e809a59a3ac

SHA256
ea000c3fc6382351ee6de24b0ee40515d52809957f14302e9a9c2ae407771e58

SHA512
03c18489ec7581b3f2fb7d80823506b575b6ff43b26c54a246bd191f8060fc0e480350495ee2706f4e6835e68dee0378faa0c77249b85e356f7b02527ed21090

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\elrbnedq.cmdline

Filesize
349B

MD5
ed291392d233296d8b4bad58a8985792

SHA1
3b57c825efd3f98110801bb807ed901b25bbf1f4

SHA256
a906ca0ec067818ba90cb2d2c44f14998d32b6a5fe9e5791d4a6e3625aa5d955

SHA512
9f8e16d6e544c114d3929f26486720908c228eb1d6b40ee1442c08ae3a2f4ba8df2f243ca948d1e010798117ed5680cff5d3190a513ad53b1180d4aa296b817f

Download Submit
memory/856-96-0x000000001DBE0000-0x000000001DBE8000-memory.dmp

Filesize
32KB

Download
memory/856-105-0x000000001DBE0000-0x000000001DBEA000-memory.dmp

Filesize
40KB

Download
memory/856-24-0x000000001C1E0000-0x000000001C1EA000-memory.dmp

Filesize
40KB

Download
memory/856-25-0x000000001C200000-0x000000001C208000-memory.dmp

Filesize
32KB

Download
memory/856-26-0x000000001D890000-0x000000001D8B0000-memory.dmp

Filesize
128KB

Download
memory/856-21-0x000000001D010000-0x000000001D026000-memory.dmp

Filesize
88KB

Download
memory/856-1-0x00007FFDC0850000-0x00007FFDC11F1000-memory.dmp

Filesize
9.6MB

Download
memory/856-3-0x0000000001A70000-0x0000000001A7E000-memory.dmp

Filesize
56KB

Download
memory/856-2-0x000000001C0B0000-0x000000001C10C000-memory.dmp

Filesize
368KB

Download
memory/856-4-0x00007FFDC0850000-0x00007FFDC11F1000-memory.dmp

Filesize
9.6MB

Download
memory/856-5-0x000000001CA00000-0x000000001CECE000-memory.dmp

Filesize
4.8MB

Download
memory/856-6-0x000000001CF70000-0x000000001D00C000-memory.dmp

Filesize
624KB

Download
memory/856-146-0x000000001E4B0000-0x000000001E4D6000-memory.dmp

Filesize
152KB

Download
memory/856-145-0x000000001E040000-0x000000001E05E000-memory.dmp

Filesize
120KB

Download
memory/856-64-0x000000001DB60000-0x000000001DB6E000-memory.dmp

Filesize
56KB

Download
memory/856-65-0x000000001DB60000-0x000000001DBE4000-memory.dmp

Filesize
528KB

Download
memory/856-66-0x000000001DBA0000-0x000000001DBA8000-memory.dmp

Filesize
32KB

Download
memory/856-68-0x000000001E060000-0x000000001E068000-memory.dmp

Filesize
32KB

Download
memory/856-67-0x000000001E060000-0x000000001E068000-memory.dmp

Filesize
32KB

Download
memory/856-69-0x000000001E060000-0x000000001E06C000-memory.dmp

Filesize
48KB

Download
memory/856-70-0x000000001E060000-0x000000001E06A000-memory.dmp

Filesize
40KB

Download
memory/856-71-0x000000001E3A0000-0x000000001E3D0000-memory.dmp

Filesize
192KB

Download
memory/856-72-0x000000001E3F0000-0x000000001E464000-memory.dmp

Filesize
464KB

Download
memory/856-73-0x000000001E670000-0x000000001E970000-memory.dmp

Filesize
3.0MB

Download
memory/856-75-0x000000001E370000-0x000000001E390000-memory.dmp

Filesize
128KB

Download
memory/856-76-0x000000001E060000-0x000000001E06E000-memory.dmp

Filesize
56KB

Download
memory/856-77-0x000000001E410000-0x000000001E4A4000-memory.dmp

Filesize
592KB

Download
memory/856-78-0x0000000140000000-0x000000014002C000-memory.dmp

Filesize
176KB

Download
memory/856-84-0x00007FFDC0B05000-0x00007FFDC0B06000-memory.dmp

Filesize
4KB

Download
memory/856-85-0x00007FFDC0850000-0x00007FFDC11F1000-memory.dmp

Filesize
9.6MB

Download
memory/856-86-0x000000001E040000-0x000000001E058000-memory.dmp

Filesize
96KB

Download
memory/856-87-0x000000001E040000-0x000000001E056000-memory.dmp

Filesize
88KB

Download
memory/856-88-0x000000001E4B0000-0x000000001E4DA000-memory.dmp

Filesize
168KB

Download
memory/856-89-0x000000001DBE0000-0x000000001DBE8000-memory.dmp

Filesize
32KB

Download
memory/856-90-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-91-0x000000001E040000-0x000000001E060000-memory.dmp

Filesize
128KB

Download
memory/856-92-0x000000001E4B0000-0x000000001E4D6000-memory.dmp

Filesize
152KB

Download
memory/856-93-0x000000001E4F0000-0x000000001E530000-memory.dmp

Filesize
256KB

Download
memory/856-94-0x000000001E4F0000-0x000000001E52E000-memory.dmp

Filesize
248KB

Download
memory/856-95-0x000000001E4B0000-0x000000001E4DC000-memory.dmp

Filesize
176KB

Download
memory/856-0-0x00007FFDC0B05000-0x00007FFDC0B06000-memory.dmp

Filesize
4KB

Download
memory/856-97-0x000000001DBE0000-0x000000001DBEA000-memory.dmp

Filesize
40KB

Download
memory/856-98-0x000000001E4B0000-0x000000001E4D4000-memory.dmp

Filesize
144KB

Download
memory/856-99-0x000000001E4B0000-0x000000001E4D8000-memory.dmp

Filesize
160KB

Download
memory/856-100-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-101-0x000000001DBE0000-0x000000001DBEA000-memory.dmp

Filesize
40KB

Download
memory/856-102-0x000000001E040000-0x000000001E05E000-memory.dmp

Filesize
120KB

Download
memory/856-103-0x000000001E040000-0x000000001E05E000-memory.dmp

Filesize
120KB

Download
memory/856-104-0x000000001DBE0000-0x000000001DBE8000-memory.dmp

Filesize
32KB

Download
memory/856-23-0x0000000001AC0000-0x0000000001AD2000-memory.dmp

Filesize
72KB

Download
memory/856-106-0x000000001DBE0000-0x000000001DBEE000-memory.dmp

Filesize
56KB

Download
memory/856-107-0x000000001E040000-0x000000001E054000-memory.dmp

Filesize
80KB

Download
memory/856-108-0x000000001DBE0000-0x000000001DBF0000-memory.dmp

Filesize
64KB

Download
memory/856-109-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-110-0x000000001E4B0000-0x000000001E4D8000-memory.dmp

Filesize
160KB

Download
memory/856-111-0x000000001DBE0000-0x000000001DBEA000-memory.dmp

Filesize
40KB

Download
memory/856-112-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-113-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-114-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-115-0x000000001E040000-0x000000001E054000-memory.dmp

Filesize
80KB

Download
memory/856-116-0x000000001E040000-0x000000001E058000-memory.dmp

Filesize
96KB

Download
memory/856-117-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-118-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-119-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-120-0x000000001DBE0000-0x000000001DBF0000-memory.dmp

Filesize
64KB

Download
memory/856-121-0x000000001DBE0000-0x000000001DBEE000-memory.dmp

Filesize
56KB

Download
memory/856-122-0x000000001E4B0000-0x000000001E4D2000-memory.dmp

Filesize
136KB

Download
memory/856-123-0x000000001E040000-0x000000001E05C000-memory.dmp

Filesize
112KB

Download
memory/856-124-0x000000001E040000-0x000000001E054000-memory.dmp

Filesize
80KB

Download
memory/856-125-0x000000001E040000-0x000000001E05A000-memory.dmp

Filesize
104KB

Download
memory/856-126-0x000000001DBE0000-0x000000001DBEC000-memory.dmp

Filesize
48KB

Download
memory/856-127-0x000000001DBE0000-0x000000001DBEE000-memory.dmp

Filesize
56KB

Download
memory/856-128-0x000000001E040000-0x000000001E058000-memory.dmp

Filesize
96KB

Download
memory/856-129-0x000000001E040000-0x000000001E052000-memory.dmp

Filesize
72KB

Download
memory/856-130-0x000000001DBE0000-0x000000001DBEE000-memory.dmp

Filesize
56KB

Download
memory/856-132-0x000000001DBE0000-0x000000001DBE8000-memory.dmp

Filesize
32KB

Download
memory/856-134-0x00007FFDC0850000-0x00007FFDC11F1000-memory.dmp

Filesize
9.6MB

Download
memory/856-133-0x000000001E040000-0x000000001E05C000-memory.dmp

Filesize
112KB

Download
memory/856-131-0x000000001DBE0000-0x000000001DBEA000-memory.dmp

Filesize
40KB

Download
memory/856-139-0x000000001DBE0000-0x000000001DBEE000-memory.dmp

Filesize
56KB

Download
memory/856-138-0x000000001DBE0000-0x000000001DBE8000-memory.dmp

Filesize
32KB

Download
memory/856-137-0x000000001DBE0000-0x000000001DBE8000-memory.dmp

Filesize
32KB

Download
memory/856-136-0x000000001DBE0000-0x000000001DBE8000-memory.dmp

Filesize
32KB

Download
memory/856-135-0x000000001E040000-0x000000001E05C000-memory.dmp

Filesize
112KB

Download
memory/856-140-0x000000001E040000-0x000000001E052000-memory.dmp

Filesize
72KB

Download
memory/856-141-0x000000001DBE0000-0x000000001DBEE000-memory.dmp

Filesize
56KB

Download
memory/856-142-0x000000001DBE0000-0x000000001DBEA000-memory.dmp

Filesize
40KB

Download
memory/856-143-0x000000001E4B0000-0x000000001E4DA000-memory.dmp

Filesize
168KB

Download
memory/856-144-0x000000001E4B0000-0x000000001E4D8000-memory.dmp

Filesize
160KB

Download
memory/1544-57-0x000001C765CA0000-0x000001C765CC2000-memory.dmp

Filesize
136KB

Download
memory/1672-48-0x000000001A3C0000-0x000000001A4CA000-memory.dmp

Filesize
1.0MB

Download
memory/2392-15-0x00007FFDC0850000-0x00007FFDC11F1000-memory.dmp

Filesize
9.6MB

Download
memory/2392-19-0x00007FFDC0850000-0x00007FFDC11F1000-memory.dmp

Filesize
9.6MB

Download
memory/3604-43-0x0000000001920000-0x000000000195C000-memory.dmp

Filesize
240KB

Download
memory/3604-42-0x00000000018C0000-0x00000000018D2000-memory.dmp

Filesize
72KB

Download
memory/3604-41-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

Filesize
48KB

Download
memory/3604-40-0x00007FFDBCF03000-0x00007FFDBCF05000-memory.dmp

Filesize
8KB

Download