orcus | e67c3d893e403f8974605d2c77bf66930c880de94dddb02dc13ce7c8d40ad700

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xda.exe
Size

3.0MB
MD5

cf6aa82e9cb164a4ddd30a1f77db1eb7
SHA1

60790744a396419695221c39aee74672bc67fa66
SHA256

e67c3d893e403f8974605d2c77bf66930c880de94dddb02dc13ce7c8d40ad700
SHA512

e9465d2469199972ece28fde93be701e15d97bb495ee75545161ebb8712591b04867110d8632fce712295399c89338fdfe2c7c5179f597bffd8e3c679b95ae09
SSDEEP

49152:XzTEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmWrZEIN:XzTtODUKTslWp2MpbfGGilIJPypSbxE8

Score

10^/10

orcus defense_evasion discovery evasion persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

orcus

89.23.100.155:1337

Mutex

d058ef377b7f46bea0e52b669562775b

Attributes

autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4304-24-0x0000000001030000-0x000000000103A000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Orcus.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcus main payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023b13-288.dat	family_orcus
behavioral2/files/0x0008000000023c69-294.dat	family_orcus

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe

Orcurs Rat Executable 3 IoCs

resource	yara_rule
behavioral2/memory/4304-73-0x000000001DAD0000-0x000000001DDD0000-memory.dmp	orcus
behavioral2/files/0x000f000000023b13-288.dat	orcus
behavioral2/files/0x0008000000023c69-294.dat	orcus

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	OrcusWatchdog.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	xda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Orcus.exe

Executes dropped EXE 6 IoCs

pid	Process
2808	WindowsInput.exe
4900	WindowsInput.exe
2800	Orcus.exe
4516	Orcus.exe
4656	OrcusWatchdog.exe
2084	OrcusWatchdog.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Orcus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Orcus = "\"C:\\Program Files\\Orcus\\Orcus.exe\""	Orcus.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xda.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	Orcus.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe	xda.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	xda.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Orcus\Orcus.exe.config	xda.exe
File created	C:\Program Files\Orcus\Orcus.exe	xda.exe
File opened for modification	C:\Program Files\Orcus\Orcus.exe	xda.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrcusWatchdog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrcusWatchdog.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1136	powershell.exe
1136	powershell.exe
1028	powershell.exe
1028	powershell.exe
2800	Orcus.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe
2800	Orcus.exe
2084	OrcusWatchdog.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	2800	Orcus.exe
Token: SeDebugPrivilege	4656	OrcusWatchdog.exe
Token: SeDebugPrivilege	2084	OrcusWatchdog.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2800	Orcus.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2800	Orcus.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 1436	4304	xda.exe	87
PID 4304 wrote to memory of 1436	4304	xda.exe	87
PID 1436 wrote to memory of 1516	1436	csc.exe	89
PID 1436 wrote to memory of 1516	1436	csc.exe	89
PID 4304 wrote to memory of 2808	4304	xda.exe	91
PID 4304 wrote to memory of 2808	4304	xda.exe	91
PID 4304 wrote to memory of 1136	4304	xda.exe	95
PID 4304 wrote to memory of 1136	4304	xda.exe	95
PID 4304 wrote to memory of 2800	4304	xda.exe	108
PID 4304 wrote to memory of 2800	4304	xda.exe	108
PID 2800 wrote to memory of 1028	2800	Orcus.exe	110
PID 2800 wrote to memory of 1028	2800	Orcus.exe	110
PID 2800 wrote to memory of 4656	2800	Orcus.exe	112
PID 2800 wrote to memory of 4656	2800	Orcus.exe	112
PID 2800 wrote to memory of 4656	2800	Orcus.exe	112
PID 4656 wrote to memory of 2084	4656	OrcusWatchdog.exe	114
PID 4656 wrote to memory of 2084	4656	OrcusWatchdog.exe	114
PID 4656 wrote to memory of 2084	4656	OrcusWatchdog.exe	114

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	Orcus.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xda.exe
"C:\Users\Admin\AppData\Local\Temp\xda.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4304
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zvftmcom.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA152.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA151.tmp"
    3⤵
    PID:1516
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- - C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
    "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2800
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
      "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2800
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2084

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:4900

C:\Program Files\Orcus\Orcus.exe
"C:\Program Files\Orcus\Orcus.exe"
1⤵
- Executes dropped EXE
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Orcus\Orcus.exe

Filesize
3.0MB

MD5
cf6aa82e9cb164a4ddd30a1f77db1eb7

SHA1
60790744a396419695221c39aee74672bc67fa66

SHA256
e67c3d893e403f8974605d2c77bf66930c880de94dddb02dc13ce7c8d40ad700

SHA512
e9465d2469199972ece28fde93be701e15d97bb495ee75545161ebb8712591b04867110d8632fce712295399c89338fdfe2c7c5179f597bffd8e3c679b95ae09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OrcusWatchdog.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\1046.exe

Filesize
3.0MB

MD5
86c168112d2ca3e45d3a2c4a0ed5b261

SHA1
7f63b4b0564f3d0393b9ade80843fffe94149aa8

SHA256
fee1fee22df1dc900f56b91ab08b3360a4c2ade7a6e7a872870b70878e2ab0a5

SHA512
8da0a343b57ff59ddf2350a41d6fd583de1838d83beb7e328eba52ed1ffa9b54627cc85040e76303be9526046e269bf71a0a408e67f892da85b08cfb13605e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA152.tmp

Filesize
1KB

MD5
90d4a8436250cf164b8944261a061f1e

SHA1
4a342ff170cc556dbbbd5ed9cd44cfb9ccda78c0

SHA256
427556778fbc674da4e15763faa4d2b966b9a450a23e1bf943ab3422877085c3

SHA512
16a8e6d415b9c4f4b8c5d9758103aa25d0b945e1e87af67ab1372454c23815132011b5578b4a798ab55a5981475ad81584a765e1ad51bdae2724e21943762638

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qyhlhmv2.ga5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvftmcom.dll

Filesize
76KB

MD5
45a5123f772adc0a77b0cfa86bc54610

SHA1
57d78aa0ef59de65006703fd1e70ffb98899d829

SHA256
c6156a926fe994cb78efae0e50ac1c2dc34391e204265c4150dffe136da2eb82

SHA512
6af23ee4c228433391b2010267de253b6eedf8465366c3f661907ecd6f1342e8a6e6d19b3305d5a9247381290faa76f182f11259eb5217fda1fb85fec1dd62b4

Download Submit
C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

Filesize
9KB

MD5
7a195b6c9de2d5cab015f649da6931a1

SHA1
89f7372dd92a90a8e13b74ee512b464412e4cf9b

SHA256
30183935449a625c2a61f6342dc3b9907028194173f2e3d594eaa3126ee316bc

SHA512
3c2aeef85b51e7f955072fba042bcedf8dd0b66ad813def58c0134355665ba56a713d58005a322561c62be5777d0adea2803da214459f362f22fe2a0dba5a1c7

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
f6285edd247fa58161be33f8cf662d31

SHA1
e2b49bca43cd0bd6cc1eee582ba58f0ed6de1470

SHA256
bc16993d1a774793044ca37eb2ce84ecbdb5c578e3c710ed82879e07dcef2fec

SHA512
6f3e6073a1dafc679da1caa4a4c9cb7cc2da79c3f81034d7b7b7b1d855fd5421cbb517a7d3f9520f49d4d3b7f9577f4f8f92486994c8b78fabff5033b390a788

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config

Filesize
349B

MD5
89817519e9e0b4e703f07e8c55247861

SHA1
4636de1f6c997a25c3190f73f46a3fd056238d78

SHA256
f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13

SHA512
b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCA151.tmp

Filesize
676B

MD5
099d99a9592ec3153ed2ee86a353c8a1

SHA1
2c864c21278fa5fdffbc7e92b8b5085dd645642d

SHA256
4ad709abaa21b9493c9cdd113388c8177f73f4461f8aefa9e623650ed58807c9

SHA512
adc5185389792e5fd2dac30b4e0931e32f881ffa3d194d8cf4dac576c7909317fcd4d1e782e673cb11aac074aee2f5a201b3c1b83fa765d2fe2be7a1e7d37ec5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zvftmcom.0.cs

Filesize
208KB

MD5
64a7007e6b2de196967b2b496dc5faea

SHA1
cfd0c00bef23f883a554ee11a38ec6fbbc85fd4a

SHA256
d8d239a786035ab6179aa67e3954f5952cf8b3dc36de5e1eab7f08fae5f18c42

SHA512
82a36dbdf2fb0a086e4bf244c6554559050557acb213c110625b57ff948572f6a49778b097b5dda5d4833b2aa478d6e7cc1934c284923b3053f9a48391d06b1b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zvftmcom.cmdline

Filesize
349B

MD5
cf40f9fcc9058799974d6d937419073e

SHA1
25ae6bc3fa0b6b666ac1365b8359d32f69b589fc

SHA256
92b4781bbc2d32687ded7012e3b04147b0aad04e582995ca7240e39ffbaa7275

SHA512
109bd76471e922fe1af02d45e1cbf5519a1d773e228c0d00e138af6a448a77d1da430a43dc56da042099c44f386a9c51058705a2e5bd7e78a4248c4061139113

Download Submit
memory/1136-52-0x00000227B1B70000-0x00000227B1B92000-memory.dmp

Filesize
136KB

Download
memory/1436-19-0x00007FF98C040000-0x00007FF98C9E1000-memory.dmp

Filesize
9.6MB

Download
memory/1436-12-0x00007FF98C040000-0x00007FF98C9E1000-memory.dmp

Filesize
9.6MB

Download
memory/2808-43-0x000000001B6A0000-0x000000001B6DC000-memory.dmp

Filesize
240KB

Download
memory/2808-42-0x0000000002C10000-0x0000000002C22000-memory.dmp

Filesize
72KB

Download
memory/2808-40-0x0000000000A80000-0x0000000000A8C000-memory.dmp

Filesize
48KB

Download
memory/2808-41-0x00007FF988003000-0x00007FF988005000-memory.dmp

Filesize
8KB

Download
memory/4304-109-0x000000001D950000-0x000000001D98E000-memory.dmp

Filesize
248KB

Download
memory/4304-121-0x000000001D060000-0x000000001D06E000-memory.dmp

Filesize
56KB

Download
memory/4304-24-0x0000000001030000-0x000000000103A000-memory.dmp

Filesize
40KB

Download
memory/4304-25-0x0000000001060000-0x0000000001068000-memory.dmp

Filesize
32KB

Download
memory/4304-0-0x00007FF98C2F5000-0x00007FF98C2F6000-memory.dmp

Filesize
4KB

Download
memory/4304-23-0x0000000001190000-0x00000000011A2000-memory.dmp

Filesize
72KB

Download
memory/4304-21-0x00000000011C0000-0x00000000011D6000-memory.dmp

Filesize
88KB

Download
memory/4304-64-0x000000001CFE0000-0x000000001CFEE000-memory.dmp

Filesize
56KB

Download
memory/4304-65-0x000000001CFD0000-0x000000001D054000-memory.dmp

Filesize
528KB

Download
memory/4304-66-0x000000001D020000-0x000000001D028000-memory.dmp

Filesize
32KB

Download
memory/4304-67-0x000000001D7E0000-0x000000001D7E8000-memory.dmp

Filesize
32KB

Download
memory/4304-68-0x000000001D7E0000-0x000000001D7E8000-memory.dmp

Filesize
32KB

Download
memory/4304-69-0x000000001D7E0000-0x000000001D7EC000-memory.dmp

Filesize
48KB

Download
memory/4304-70-0x000000001D7E0000-0x000000001D7EA000-memory.dmp

Filesize
40KB

Download
memory/4304-71-0x000000001D800000-0x000000001D830000-memory.dmp

Filesize
192KB

Download
memory/4304-72-0x000000001D850000-0x000000001D8C4000-memory.dmp

Filesize
464KB

Download
memory/4304-73-0x000000001DAD0000-0x000000001DDD0000-memory.dmp

Filesize
3.0MB

Download
memory/4304-75-0x00007FF98C2F5000-0x00007FF98C2F6000-memory.dmp

Filesize
4KB

Download
memory/4304-76-0x00007FF98C040000-0x00007FF98C9E1000-memory.dmp

Filesize
9.6MB

Download
memory/4304-77-0x000000001D7F0000-0x000000001D810000-memory.dmp

Filesize
128KB

Download
memory/4304-78-0x000000001D7E0000-0x000000001D7EE000-memory.dmp

Filesize
56KB

Download
memory/4304-79-0x00007FF98C040000-0x00007FF98C9E1000-memory.dmp

Filesize
9.6MB

Download
memory/4304-80-0x000000001D870000-0x000000001D904000-memory.dmp

Filesize
592KB

Download
memory/4304-82-0x000000001D480000-0x000000001D50E000-memory.dmp

Filesize
568KB

Download
memory/4304-84-0x000000001D480000-0x000000001D532000-memory.dmp

Filesize
712KB

Download
memory/4304-93-0x000000001D480000-0x000000001D538000-memory.dmp

Filesize
736KB

Download
memory/4304-95-0x0000000140000000-0x000000014002C000-memory.dmp

Filesize
176KB

Download
memory/4304-101-0x000000001D930000-0x000000001D948000-memory.dmp

Filesize
96KB

Download
memory/4304-102-0x000000001D930000-0x000000001D946000-memory.dmp

Filesize
88KB

Download
memory/4304-103-0x000000001D940000-0x000000001D96A000-memory.dmp

Filesize
168KB

Download
memory/4304-104-0x000000001D920000-0x000000001D928000-memory.dmp

Filesize
32KB

Download
memory/4304-105-0x000000001D920000-0x000000001D92C000-memory.dmp

Filesize
48KB

Download
memory/4304-106-0x000000001D930000-0x000000001D950000-memory.dmp

Filesize
128KB

Download
memory/4304-107-0x000000001D940000-0x000000001D966000-memory.dmp

Filesize
152KB

Download
memory/4304-108-0x000000001D950000-0x000000001D990000-memory.dmp

Filesize
256KB

Download
memory/4304-6-0x000000001C440000-0x000000001C4DC000-memory.dmp

Filesize
624KB

Download
memory/4304-111-0x000000001D920000-0x000000001D928000-memory.dmp

Filesize
32KB

Download
memory/4304-110-0x000000001D940000-0x000000001D96C000-memory.dmp

Filesize
176KB

Download
memory/4304-112-0x000000001D920000-0x000000001D92A000-memory.dmp

Filesize
40KB

Download
memory/4304-113-0x000000001D940000-0x000000001D964000-memory.dmp

Filesize
144KB

Download
memory/4304-114-0x000000001D940000-0x000000001D968000-memory.dmp

Filesize
160KB

Download
memory/4304-115-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-116-0x000000001D060000-0x000000001D06A000-memory.dmp

Filesize
40KB

Download
memory/4304-117-0x000000001D910000-0x000000001D92E000-memory.dmp

Filesize
120KB

Download
memory/4304-118-0x000000001D910000-0x000000001D92E000-memory.dmp

Filesize
120KB

Download
memory/4304-119-0x000000001D060000-0x000000001D068000-memory.dmp

Filesize
32KB

Download
memory/4304-120-0x000000001D060000-0x000000001D06A000-memory.dmp

Filesize
40KB

Download
memory/4304-26-0x000000001CD20000-0x000000001CD40000-memory.dmp

Filesize
128KB

Download
memory/4304-122-0x000000001D910000-0x000000001D924000-memory.dmp

Filesize
80KB

Download
memory/4304-123-0x000000001D060000-0x000000001D070000-memory.dmp

Filesize
64KB

Download
memory/4304-124-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-125-0x000000001D940000-0x000000001D968000-memory.dmp

Filesize
160KB

Download
memory/4304-126-0x000000001D060000-0x000000001D06A000-memory.dmp

Filesize
40KB

Download
memory/4304-127-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-128-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-129-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-130-0x000000001D910000-0x000000001D924000-memory.dmp

Filesize
80KB

Download
memory/4304-131-0x000000001D910000-0x000000001D928000-memory.dmp

Filesize
96KB

Download
memory/4304-132-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-133-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-134-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-136-0x000000001D060000-0x000000001D06E000-memory.dmp

Filesize
56KB

Download
memory/4304-135-0x000000001D060000-0x000000001D070000-memory.dmp

Filesize
64KB

Download
memory/4304-137-0x000000001D940000-0x000000001D962000-memory.dmp

Filesize
136KB

Download
memory/4304-138-0x000000001D910000-0x000000001D92C000-memory.dmp

Filesize
112KB

Download
memory/4304-139-0x000000001D910000-0x000000001D924000-memory.dmp

Filesize
80KB

Download
memory/4304-140-0x000000001D910000-0x000000001D92A000-memory.dmp

Filesize
104KB

Download
memory/4304-141-0x000000001D060000-0x000000001D06C000-memory.dmp

Filesize
48KB

Download
memory/4304-144-0x000000001D910000-0x000000001D922000-memory.dmp

Filesize
72KB

Download
memory/4304-145-0x000000001D060000-0x000000001D06E000-memory.dmp

Filesize
56KB

Download
memory/4304-143-0x000000001D910000-0x000000001D928000-memory.dmp

Filesize
96KB

Download
memory/4304-142-0x000000001D060000-0x000000001D06E000-memory.dmp

Filesize
56KB

Download
memory/4304-146-0x000000001D060000-0x000000001D06A000-memory.dmp

Filesize
40KB

Download
memory/4304-147-0x000000001D060000-0x000000001D068000-memory.dmp

Filesize
32KB

Download
memory/4304-148-0x000000001D910000-0x000000001D92C000-memory.dmp

Filesize
112KB

Download
memory/4304-149-0x000000001D910000-0x000000001D92C000-memory.dmp

Filesize
112KB

Download
memory/4304-150-0x000000001D060000-0x000000001D068000-memory.dmp

Filesize
32KB

Download
memory/4304-151-0x000000001D060000-0x000000001D068000-memory.dmp

Filesize
32KB

Download
memory/4304-152-0x000000001D060000-0x000000001D068000-memory.dmp

Filesize
32KB

Download
memory/4304-153-0x000000001D060000-0x000000001D06E000-memory.dmp

Filesize
56KB

Download
memory/4304-154-0x000000001D910000-0x000000001D922000-memory.dmp

Filesize
72KB

Download
memory/4304-155-0x000000001D060000-0x000000001D06E000-memory.dmp

Filesize
56KB

Download
memory/4304-156-0x000000001D060000-0x000000001D06A000-memory.dmp

Filesize
40KB

Download
memory/4304-157-0x000000001D940000-0x000000001D96A000-memory.dmp

Filesize
168KB

Download
memory/4304-158-0x000000001D940000-0x000000001D968000-memory.dmp

Filesize
160KB

Download
memory/4304-159-0x000000001D910000-0x000000001D92E000-memory.dmp

Filesize
120KB

Download
memory/4304-160-0x000000001DA60000-0x000000001DA86000-memory.dmp

Filesize
152KB

Download
memory/4304-5-0x000000001BED0000-0x000000001C39E000-memory.dmp

Filesize
4.8MB

Download
memory/4304-4-0x0000000000EE0000-0x0000000000EEE000-memory.dmp

Filesize
56KB

Download
memory/4304-3-0x000000001B660000-0x000000001B6BC000-memory.dmp

Filesize
368KB

Download
memory/4304-2-0x00007FF98C040000-0x00007FF98C9E1000-memory.dmp

Filesize
9.6MB

Download
memory/4304-1-0x00007FF98C040000-0x00007FF98C9E1000-memory.dmp

Filesize
9.6MB

Download
memory/4900-48-0x000000001A350000-0x000000001A45A000-memory.dmp

Filesize
1.0MB

Download