orcus | b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe
Size

2.3MB
MD5

640810384369b5434037b059e178d2cb
SHA1

67f0e5c4df09a2f6fe86574f681569e3d2bd8879
SHA256

b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17
SHA512

b504a544392c24adb40fa75756470e47cf03b921f2c0bff7f24e3af3a58a6ef2d754a6149fbaba643b1c78d05c31896172863dcd2f4d33d0bf49c46240c81958
SSDEEP

49152:y4AMirXrrcI0AilFEvxHPLPUwXNYSLNTdqjy6:y4AtUwc

Score

10^/10

orcus quasar com surrogate system discovery evasion execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

orcus

Botnet

System

199.195.253.181:25202

Mutex

ecca0f439cec4158b200af951642a93a

Attributes

autostart_method
Registry
enable_keylogger
true
install_path
%appdata%\Microsoft\speech\voices\COM Surrogate.exe
reconnect_delay
10000
registry_keyname
COM_key
taskscheduler_taskname
COM start
watchdog_path
AppData\COM Surrogate.exe

Extracted

Family

quasar

Version

1.0.0

Botnet

COM Surrogate

194.29.101.219:25201

45.91.92.112:25201

199.195.253.181:25201

Mutex

6953938f-ba49-4496-840c-af4ae63c3c3e

Attributes

encryption_key
23992CD46AE82E7A5F390707A57232703BF090FE
install_name
COM Surrogate.exe
log_directory
Logs
reconnect_delay
5000
startup_key
COM Surrogate
subdirectory
Microsoft

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x0007000000023c9c-32.dat	disable_win_def
behavioral2/memory/4128-34-0x0000000000070000-0x0000000000078000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	DISABLE-WINDOWS-DEFENDER.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	DISABLE-WINDOWS-DEFENDER.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	DISABLE-WINDOWS-DEFENDER.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	DISABLE-WINDOWS-DEFENDER.EXE

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcus main payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c94-4.dat	family_orcus

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c9b-14.dat	family_quasar
behavioral2/memory/2644-51-0x00000000001E0000-0x0000000000264000-memory.dmp	family_quasar

Orcurs Rat Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c94-4.dat	orcus
behavioral2/memory/3156-54-0x0000000000350000-0x000000000043A000-memory.dmp	orcus

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2908	powershell.exe
1556	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	EXCLUSION.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	COM SURROGATE.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	COM Surrogate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	COM Surrogate.exe

Executes dropped EXE 10 IoCs

pid	Process
3156	COM SURROGATE.EXE
2644	CONNTO-LONDON.ZURCH.NY.EXE
4128	DISABLE-WINDOWS-DEFENDER.EXE
4676	EXCLUSION.EXE
1684	PUBBEANS.EXE
2684	COM Surrogate.exe
2288	COM Surrogate.exe
316	COM Surrogate.exe
3980	COM Surrogate.exe
544	COM Surrogate.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	DISABLE-WINDOWS-DEFENDER.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM_key = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\speech\\voices\\COM Surrogate.exe\""	COM Surrogate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM Surrogate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM Surrogate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM Surrogate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM Surrogate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM SURROGATE.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1736	schtasks.exe
708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4980	powershell.exe
4980	powershell.exe
2908	powershell.exe
2908	powershell.exe
1556	powershell.exe
1556	powershell.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe
3980	COM Surrogate.exe
2288	COM Surrogate.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	CONNTO-LONDON.ZURCH.NY.EXE
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2684	COM Surrogate.exe
Token: SeDebugPrivilege	2288	COM Surrogate.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	316	COM Surrogate.exe
Token: SeDebugPrivilege	3980	COM Surrogate.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2288	COM Surrogate.exe
2684	COM Surrogate.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3156	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	82
PID 2820 wrote to memory of 3156	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	82
PID 2820 wrote to memory of 3156	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	82
PID 2820 wrote to memory of 2644	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	83
PID 2820 wrote to memory of 2644	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	83
PID 2820 wrote to memory of 4128	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	84
PID 2820 wrote to memory of 4128	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	84
PID 2820 wrote to memory of 4676	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	85
PID 2820 wrote to memory of 4676	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	85
PID 4128 wrote to memory of 4980	4128	DISABLE-WINDOWS-DEFENDER.EXE	86
PID 4128 wrote to memory of 4980	4128	DISABLE-WINDOWS-DEFENDER.EXE	86
PID 2820 wrote to memory of 1684	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	87
PID 2820 wrote to memory of 1684	2820	b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe	87
PID 4676 wrote to memory of 3952	4676	EXCLUSION.EXE	89
PID 4676 wrote to memory of 3952	4676	EXCLUSION.EXE	89
PID 3952 wrote to memory of 2908	3952	cmd.exe	91
PID 3952 wrote to memory of 2908	3952	cmd.exe	91
PID 2644 wrote to memory of 708	2644	CONNTO-LONDON.ZURCH.NY.EXE	92
PID 2644 wrote to memory of 708	2644	CONNTO-LONDON.ZURCH.NY.EXE	92
PID 2644 wrote to memory of 2684	2644	CONNTO-LONDON.ZURCH.NY.EXE	94
PID 2644 wrote to memory of 2684	2644	CONNTO-LONDON.ZURCH.NY.EXE	94
PID 3156 wrote to memory of 2288	3156	COM SURROGATE.EXE	95
PID 3156 wrote to memory of 2288	3156	COM SURROGATE.EXE	95
PID 3156 wrote to memory of 2288	3156	COM SURROGATE.EXE	95
PID 3952 wrote to memory of 1556	3952	cmd.exe	97
PID 3952 wrote to memory of 1556	3952	cmd.exe	97
PID 2288 wrote to memory of 316	2288	COM Surrogate.exe	98
PID 2288 wrote to memory of 316	2288	COM Surrogate.exe	98
PID 2288 wrote to memory of 316	2288	COM Surrogate.exe	98
PID 2684 wrote to memory of 1736	2684	COM Surrogate.exe	99
PID 2684 wrote to memory of 1736	2684	COM Surrogate.exe	99
PID 316 wrote to memory of 3980	316	COM Surrogate.exe	101
PID 316 wrote to memory of 3980	316	COM Surrogate.exe	101
PID 316 wrote to memory of 3980	316	COM Surrogate.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe
"C:\Users\Admin\AppData\Local\Temp\b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\COM SURROGATE.EXE
  "C:\Users\Admin\AppData\Local\Temp\COM SURROGATE.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Users\Admin\AppData\Roaming\Microsoft\speech\voices\COM Surrogate.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\speech\voices\COM Surrogate.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Users\Admin\AppData\Roaming\COM Surrogate.exe
      "C:\Users\Admin\AppData\Roaming\COM Surrogate.exe" /launchSelfAndExit "C:\Users\Admin\AppData\Roaming\Microsoft\speech\voices\COM Surrogate.exe" 2288 /protectFile
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:316
    - - C:\Users\Admin\AppData\Roaming\COM Surrogate.exe
        
        "C:\Users\Admin\AppData\Roaming\COM Surrogate.exe" /watchProcess "C:\Users\Admin\AppData\Roaming\Microsoft\speech\voices\COM Surrogate.exe" 2288 "/protectFile"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980
- C:\Users\Admin\AppData\Local\Temp\CONNTO-LONDON.ZURCH.NY.EXE
  "C:\Users\Admin\AppData\Local\Temp\CONNTO-LONDON.ZURCH.NY.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "COM Surrogate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\CONNTO-LONDON.ZURCH.NY.EXE" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:708
- - C:\Users\Admin\AppData\Roaming\Microsoft\COM Surrogate.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\COM Surrogate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "COM Surrogate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\COM Surrogate.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1736
- C:\Users\Admin\AppData\Local\Temp\DISABLE-WINDOWS-DEFENDER.EXE
  "C:\Users\Admin\AppData\Local\Temp\DISABLE-WINDOWS-DEFENDER.EXE"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\Users\Admin\AppData\Local\Temp\EXCLUSION.EXE
  "C:\Users\Admin\AppData\Local\Temp\EXCLUSION.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9B84.tmp\9B95.tmp\9B96.bat C:\Users\Admin\AppData\Local\Temp\EXCLUSION.EXE"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Remove-MpPreference -ExclusionExtension ".exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1556
- C:\Users\Admin\AppData\Local\Temp\PUBBEANS.EXE
  "C:\Users\Admin\AppData\Local\Temp\PUBBEANS.EXE"
  2⤵
  - Executes dropped EXE
  PID:1684

C:\Users\Admin\AppData\Roaming\Microsoft\speech\voices\COM Surrogate.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\speech\voices\COM Surrogate.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\COM Surrogate.exe.log

Filesize
1KB

MD5
0672db2ef13237d5cb85075ff4915942

SHA1
ad8b4d3eb5e40791c47d48b22e273486f25f663f

SHA256
0a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519

SHA512
84ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
04114c0529b116bf66d764ff6a5a8fe3

SHA1
0caeff17d1b2190f76c9bf539105f6c40c92bd14

SHA256
fd7092b4e273314186bad6ce71aa4cd69450736b6ec6cc746868997ff82a7532

SHA512
6a718c330824346606ef24f71cca6be0bfafc626b1d2b060b36e919ab07f3d6a345f56cace8a5a84ffbe2183976eb197842c9fd2f3e3b8c8dd307057d59d6f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\9B84.tmp\9B95.tmp\9B96.bat

Filesize
144B

MD5
b6b3386737f7aac25b3bbe3d9e401ca5

SHA1
56799602f71f31ebe34f3064eb251c57cc90e4ff

SHA256
3a1ccedf61cd0760b70d153c760650b3cc89629fc8defae3e2cefabfcf5c3c46

SHA512
d7f6c01b9d9e4faec84eeac943033cae76aab676136396fa61a6dca16f4613c8906d2982d9bbf08999ea5353a6de1def4e0569ad601cface3b1bde0853b05014

Download Submit
C:\Users\Admin\AppData\Local\Temp\COM SURROGATE.EXE

Filesize
913KB

MD5
0f1c7991b1c30ed0626cf60660edc373

SHA1
e8b918d39ead158f83d95bcd676611d2a9a88aa2

SHA256
927f3d315f024beb4cd71ec36a465b75f39a21027b69140777e4d96a70556165

SHA512
275eb9b90f17b6cafd8b81787881cfc2740e946996b64b483c3a18416471bf3d49b40781bbf86f2161e5525089cf38456975c65e0c756c3df37886bb6105453c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CONNTO-LONDON.ZURCH.NY.EXE

Filesize
502KB

MD5
a507f854876e33aac0eea1898bb48ac9

SHA1
cffe8ac84871c5b43b42fbb217e499bc1d5ec498

SHA256
9ceb5ea5cdb7eb88147becd0693d9b77a65ceabd6e7eea8dcc85ae1cb23a2680

SHA512
0808c1c3063c4375903ae879459bcd2255b99e594b752f093ea187403736668d69aa0d6fc71ecc302b7563a155d26843adbe6875692da45a6cac1a7db20a46d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DISABLE-WINDOWS-DEFENDER.EXE

Filesize
12KB

MD5
1371bc13031cccf40f774498c1b237ed

SHA1
c264fde57d5d0dd3a0baced76748c183ddd8ccb6

SHA256
915a0a6d2c065dee5cc83917df842e0ebe455482578100dea1380d7d9080a82a

SHA512
6b93090b2a4190b031bfb97524099fe456e550a6639cc5341e201f4cf51f449ad522854a7302c3943d59d94755ea9e6e24d8d1b222d7674455ce70083279311f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXCLUSION.EXE

Filesize
120KB

MD5
c28c98d39d0e7c62db6f3fbead74a442

SHA1
a48dc75de49c2e22917054f3189940ddb438520b

SHA256
506eb6c4080a854c610dc343ea0a67d10f419a6b5239d0a57f2fa48498e08ad6

SHA512
e0e3961a9b5e8f0eeab9780507476c2b7507c074f19575e69e4373f62694ab828127b2b8ca1e239a3798ce5194fcfc0923ba8a2014e502a79e69fd6c0bcb9528

Download Submit
C:\Users\Admin\AppData\Local\Temp\PUBBEANS.EXE

Filesize
635KB

MD5
4b5f6b74a31359f8914e140c67463a6e

SHA1
ca1d9ef98d5e25239b4fc5d47905d645ae45971a

SHA256
9bb520fe2dcc27773cbb9be2360e020ea13569f7a6f3192106a8a964621ffb4c

SHA512
fd08a490b9cabd805702dc9f1765b3f346ea54f218060e77d4fd2021da5d6105cf8868abf9e2c03b2cca5667d9d7b6419bd23537bdb0893a4ccb1c5d6808bb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ylfrlnba.5tr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\COM Surrogate.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\speech\voices\COM Surrogate.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
memory/316-141-0x0000000000E90000-0x0000000000E98000-memory.dmp

Filesize
32KB

Download
memory/2288-111-0x0000000005A30000-0x0000000005A7E000-memory.dmp

Filesize
312KB

Download
memory/2288-126-0x0000000006530000-0x000000000653A000-memory.dmp

Filesize
40KB

Download
memory/2288-116-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/2288-115-0x0000000006650000-0x0000000006812000-memory.dmp

Filesize
1.8MB

Download
memory/2288-114-0x0000000005AF0000-0x0000000005B08000-memory.dmp

Filesize
96KB

Download
memory/2288-110-0x0000000005630000-0x0000000005642000-memory.dmp

Filesize
72KB

Download
memory/2644-51-0x00000000001E0000-0x0000000000264000-memory.dmp

Filesize
528KB

Download
memory/2644-33-0x00007FFB33813000-0x00007FFB33815000-memory.dmp

Filesize
8KB

Download
memory/2684-145-0x000000001D510000-0x000000001D5C2000-memory.dmp

Filesize
712KB

Download
memory/2684-144-0x000000001B310000-0x000000001B360000-memory.dmp

Filesize
320KB

Download
memory/3156-54-0x0000000000350000-0x000000000043A000-memory.dmp

Filesize
936KB

Download
memory/3156-58-0x0000000002610000-0x000000000261E000-memory.dmp

Filesize
56KB

Download
memory/3156-59-0x0000000004CD0000-0x0000000004D2C000-memory.dmp

Filesize
368KB

Download
memory/3156-55-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

Filesize
4KB

Download
memory/3156-73-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/3156-60-0x00000000052E0000-0x0000000005884000-memory.dmp

Filesize
5.6MB

Download
memory/3156-61-0x0000000004E10000-0x0000000004EA2000-memory.dmp

Filesize
584KB

Download
memory/4128-92-0x00007FFB33810000-0x00007FFB342D1000-memory.dmp

Filesize
10.8MB

Download
memory/4128-52-0x00007FFB33810000-0x00007FFB342D1000-memory.dmp

Filesize
10.8MB

Download
memory/4128-34-0x0000000000070000-0x0000000000078000-memory.dmp

Filesize
32KB

Download
memory/4980-71-0x000002B13D470000-0x000002B13D492000-memory.dmp

Filesize
136KB

Download