orcus | 3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3

Analysis

max time kernel
496s
max time network
485s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OrcusRAT-main.zip
Size

25.0MB
MD5

4ebe8621171038676189cbc5e7053d9f
SHA1

2e3a3b97163d1e8af1e41c36f9495062fb4b1934
SHA256

3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3
SHA512

e0091ae9f3acddc7e8d11b89a60debc3dab57b8af57bde4a3f538b2283eae398a1adec8224bf5fd2d0be61be015fc2a79c49b06cf786945073e1cc87d66be356
SSDEEP

786432:DFrAoo07VJxiSdlBx4IVwXuOHKW3kijZk:hrA+xJBgIEuMUiNk

Score

10^/10

orcus discovery rat spyware stealer

Malware Config

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcurs Rat Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023cb9-194.dat	orcus
behavioral2/memory/4140-198-0x0000000000390000-0x00000000013CE000-memory.dmp	orcus

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Orcus.Administration.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	hawktuah.exe

Executes dropped EXE 7 IoCs

pid	Process
4140	Orcus.Administration.exe
3336	Orcus.Server.exe
3572	Orcus.Server.exe
4504	Orcus.Server.exe
872	Orcus.Server.exe
2580	hawktuah.exe
4932	AudioDriver.exe

Loads dropped DLL 47 IoCs

pid	Process
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
3336	Orcus.Server.exe
3572	Orcus.Server.exe
4504	Orcus.Server.exe
872	Orcus.Server.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	hawktuah.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	hawktuah.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
171	api.ipify.org
172	api.ipify.org

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	hawktuah.exe
File created	C:\Windows\assembly\Desktop.ini	hawktuah.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	hawktuah.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Orcus.Administration.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Orcus.Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Orcus.Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Orcus.Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Orcus.Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hawktuah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AudioDriver.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AudioDriver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	AudioDriver.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AudioDriver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 500031000000000047590554100041646d696e003c0009000400efbe4759f1499e5922ad2e00000065e10100000001000000000000000000000000000000b49f1800410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Orcus.Administration.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5a003100000000009e59b0ad10005345525645527e310000420009000400efbe9e59b0ad9e59b0ad2e000000410700000000040000000000000000000000000000008526a80073006500720076006500720020003100000018000000	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "5"	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 64003100000000004656140910004f52435553527e3100004c0009000400efbe9e5924ad9e5925ad2e000000b63c0200000007000000000000000000000000000000809698004f0072006300750073005200410054002d006d00610069006e00000018000000	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 64003100000000009e59b7ad10004f52435553527e3100004c0009000400efbe9e5924ad9e59b7ad2e000000b63c0200000007000000000000000000000000000000e6ec2b014f0072006300750073005200410054002d006d00610069006e00000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0 = 5a003100000000009e59b8ad10005345525645527e310000420009000400efbe9e59b7ad9e59b8ad2e000000410700000000050000000000000000000000000000007eda180173006500720076006500720020003100000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Orcus.Administration.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Orcus.Administration.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Orcus.Administration.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 78003100000000004759f1491100557365727300640009000400efbe874f77489e5922ad2e000000c70500000000010000000000000000003a00000000000795170155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3480	explorer.exe
5044	explorer.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
4460	msedge.exe
4460	msedge.exe
3960	msedge.exe
3960	msedge.exe
3592	msedge.exe
3592	msedge.exe
4932	AudioDriver.exe
4932	AudioDriver.exe
4932	AudioDriver.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1640	7zFM.exe
5044	explorer.exe
4932	AudioDriver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	1640	7zFM.exe
Token: 35	1640	7zFM.exe
Token: SeSecurityPrivilege	1640	7zFM.exe
Token: SeDebugPrivilege	4140	Orcus.Administration.exe
Token: 33	3344	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3344	AUDIODG.EXE
Token: SeDebugPrivilege	3336	Orcus.Server.exe
Token: SeDebugPrivilege	3572	Orcus.Server.exe
Token: SeDebugPrivilege	4504	Orcus.Server.exe
Token: SeDebugPrivilege	872	Orcus.Server.exe
Token: SeDebugPrivilege	4932	AudioDriver.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1640	7zFM.exe
1640	7zFM.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3336	Orcus.Server.exe
3336	Orcus.Server.exe
3572	Orcus.Server.exe
3572	Orcus.Server.exe
4504	Orcus.Server.exe
872	Orcus.Server.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4140	Orcus.Administration.exe
4140	Orcus.Administration.exe
3480	explorer.exe
3480	explorer.exe
4140	Orcus.Administration.exe
5044	explorer.exe
5044	explorer.exe
5044	explorer.exe
5044	explorer.exe
5044	explorer.exe
5044	explorer.exe
4932	AudioDriver.exe
5044	explorer.exe
5044	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 5020	4460	msedge.exe	97
PID 4460 wrote to memory of 5020	4460	msedge.exe	97
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 1164	4460	msedge.exe	98
PID 4460 wrote to memory of 3944	4460	msedge.exe	99
PID 4460 wrote to memory of 3944	4460	msedge.exe	99
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100
PID 4460 wrote to memory of 2164	4460	msedge.exe	100

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\OrcusRAT-main.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2424

C:\Users\Admin\Desktop\OrcusRAT-main\Orcus.Administration.exe
"C:\Users\Admin\Desktop\OrcusRAT-main\Orcus.Administration.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4140
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /select, "C:\Users\Admin\Desktop\OrcusRAT-main\server 1\Orcus.Server.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4728
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /select, "C:\Users\Admin\Desktop\OrcusRAT-main\server 1\hawktuah.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/playlist?list=PLkoNiUTDHC49JF8aoemdNMuQGpWAFW9lX
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd362f46f8,0x7ffd362f4708,0x7ffd362f4718
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,5447118678420826146,15653537154668648251,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/playlist?list=PLkoNiUTDHC4_dakaSc7ePa5epYLx35DcV
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd362f46f8,0x7ffd362f4708,0x7ffd362f4718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,473590628146462718,12875402571589452940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,473590628146462718,12875402571589452940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,473590628146462718,12875402571589452940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,473590628146462718,12875402571589452940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,473590628146462718,12875402571589452940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,473590628146462718,12875402571589452940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,473590628146462718,12875402571589452940,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

C:\Users\Admin\Desktop\OrcusRAT-main\server\Orcus.Server.exe
"C:\Users\Admin\Desktop\OrcusRAT-main\server\Orcus.Server.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3336

C:\Users\Admin\Desktop\OrcusRAT-main\server\Orcus.Server.exe
"C:\Users\Admin\Desktop\OrcusRAT-main\server\Orcus.Server.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3572

C:\Users\Admin\Desktop\OrcusRAT-main\server\Orcus.Server.exe
"C:\Users\Admin\Desktop\OrcusRAT-main\server\Orcus.Server.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3480
- C:\Users\Admin\Desktop\OrcusRAT-main\server 1\Orcus.Server.exe
  "C:\Users\Admin\Desktop\OrcusRAT-main\server 1\Orcus.Server.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  PID:872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5044
- C:\Users\Admin\Desktop\OrcusRAT-main\server 1\hawktuah.exe
  "C:\Users\Admin\Desktop\OrcusRAT-main\server 1\hawktuah.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2580
- - C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
df33bf8efd579fb783e1999925e6c656

SHA1
8fef65c5e36bce77ad5394f5247415576cb24ea0

SHA256
f0fd57dc3b0b30195a56ef73681406068ab488c01371796293a46a3eddfcf3c3

SHA512
6b45f99a14144ce0d4fbdc81edf944a50fe2d4ff9af690e00e830312725aeb0bb9ecc05ac00514db18eedf37264b2f8e1cafb240e8e797cf5b7cd543df590e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
5b59cf49b48e48acb5ff6fec480b3cb4

SHA1
92202b59a8783f999f6c8b5185e051a96ed8157f

SHA256
23f738bfe72e4381d37c74881ea36ebcca0d862473ce34849bc6d68a380bd827

SHA512
6845bc0a9890d96375de0339c1eab2705a896dcfe67384379ee72277cd20fd6ef2c38625384d4a914aebd44c4b5b9bac6b04d190d769afb35b273ef72eb68bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
b742bb696a3a6eaa44f7eff2f941b7be

SHA1
3012e18d0946460958ddb8d6e346b2e64ff493dc

SHA256
348bd2cd0d3fe45ccf68ca2405a998635c231660f58ce5ab1c37866f05619489

SHA512
b85dbc2dd04da63590f82d74c12c1dd3aca3efc246dea9f92e58406b876da949bd2598172290dea0455da18bc81662404293c8a51d6a001c7ddce62adf7c6ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
126aa133353891cd72b353717a019d0a

SHA1
89d8e82013843d2fedc109ca6fb0d238fe9dd0b3

SHA256
8a08ab01b74fc48e7f14fd03dd56c531ab9da5baee8e75f28d73adf548a24f01

SHA512
ca300e503924bf545d9a367b00e13d8799f7e9d718b10429e1d3be37a0b1148f4a0eacc0670da04df486f50f6b32906445f70e021ae8ad451d8852e2b9df05a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1d8104199ce371cb68f48559b1b038e6

SHA1
2c519dc6c68d86ed8047d7f7f3fa06e99be7043f

SHA256
660d163d94e1410590e9f113346b2c63a91067e8f2fd76b0625689aff7c6edba

SHA512
ab4e9576690064f245d730062e48b0ac1d49ddd86c046b963ab0cdb78db565fdd5f21131e35d4d5d82a1be0dbe6a638ac7e81212274245f979ba985ba2eead68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c48b04ba6c2df1dc0fe574c5e0d43788

SHA1
9e185ddf1250f91f9ac6830160e0e3152c6b8fa5

SHA256
e3f26cdfa7573ca8819cb7febbce2f383749c7065849a4867f96e8081a750f30

SHA512
50bc02926b7321b655a6dc9601afd14bad6a4ac9cf844ca9d18e97cc26aa2e06368218c9749683e133bab84f656cab0e7db2a9e4bc975257214f0ade28b4382a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd00ac09ab8a4bcfa1add5c2055441d0

SHA1
fc69499f1042f1f056564af6a4998aad83bad5a7

SHA256
8201da9bafdb7d579dcb2ddd0af95a41bec1ade73fe4a44629a6d3717be7a63b

SHA512
625aa0ffd0211081332bfe761efb134100361051bb11ea5b3b80e4914468ed9142204335dd13cef65b1625757fdd8a330c9b9348c506fe8a72f4a264c4a31eee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5bff72a4ba9c00c97337b35fa26955f

SHA1
37a142e6ffce8f8b193e02368543fd2026b4a7ef

SHA256
47afbff7fa57855a152e6451de72093922351957757ecb0f4fbd5208dd560ffb

SHA512
15f6e440027e4190bd2f3bf134af8533fee6e87a326f503453a28a661a60233cfff9ce5f87363b258b2eff8cafbbbb99d92045305a3335b95789a05750f4dd0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4536ccb02ee474e31b23d8f25dbd3730

SHA1
59df13938d651d499c2a36575bad0dda4c4f72db

SHA256
2aa2d264daccfa4db32520846199116a6e62680885292f191751d272ee9a8bae

SHA512
293a043679edff55cfdbb38495fd485a066340ca423b34a8932073c85541cb4aac465b176c6f298d3db483f132b51c75a5288868258df266b50b196977c46556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0b25aa4c-d108-40e0-bbd2-38eab8cfa4db\index-dir\the-real-index

Filesize
312B

MD5
6ab7b86465301730750bea04e921535f

SHA1
4b676a23392518be9953968f4cc9d0af1cb21482

SHA256
cbbfcdd509d82ac654873da2aca33866d18536e55c1049df4f7b254c1d0259a0

SHA512
02e2f3fd86701286c9b99f9b5f4ad0425dbccae25d13cf120ca832879f3e598be40d116869bd46d55268ad39cae6662e23c08f9f52b573a50209b448856a07b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0b25aa4c-d108-40e0-bbd2-38eab8cfa4db\index-dir\the-real-index~RFe58d3f5.TMP

Filesize
48B

MD5
75e7e3e5d75a7949c4e75889e2234d40

SHA1
639ff676ce8e7a9a8b2b5ef7325c0ef18ea8cf6b

SHA256
92a608815ec249be88e802bd9add872e94f1b98bc1c3f7c4f0215550c9805b95

SHA512
8f51b1d7154b099ee45386610b2fdf9d6b79bc7527f952cd8278e32ea59fa374b41e12faf02d5af2bdc3cd43a2bd7efc3ce00309868a5ea1975cc6263ec59fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6c33256e-0bc7-4f5b-b9fb-e8afaa19b5a9\index-dir\the-real-index

Filesize
1KB

MD5
ede3e966c37e4ca613a233a6805492cf

SHA1
a80ef5dd548547815a100ed74f162a8d57384840

SHA256
d473e4871fd1f883749a96cdfa7a33c727173912757fc9531aeffa265010b780

SHA512
497aa3f2c19ef735625b8de374eed3441a156e7f6ac5232980fa0c1b9b99a2782bcd8414cb1f8adb719fae7eb2ef64cdc37f4be4ae505d7100add220007fb364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6c33256e-0bc7-4f5b-b9fb-e8afaa19b5a9\index-dir\the-real-index

Filesize
2KB

MD5
9316587d6f9fc45551738800001cff95

SHA1
cc72f1cd6156fdcb874d545902e9b80f52c3540e

SHA256
c90571242dcf610e4c23daf5b6ac3ce308ee5c4dd49424125d6e30ed26487e79

SHA512
8f227467e6f6b56b65c80195437fdd1900312559cf28d6f9496e793a43c3ddb3368b457fcedef3f3d1505cd83ad293e981995a8b77d0363fe41402e2b1f3cbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6c33256e-0bc7-4f5b-b9fb-e8afaa19b5a9\index-dir\the-real-index~RFe58d3e5.TMP

Filesize
48B

MD5
888303d29364881261be18d12265083c

SHA1
093cc299e660d0673162b4946c0ce8d5df82ad3a

SHA256
0e63e2b7f3891bfb9591ec4ec616a7906a797b6c5f21b12944d7cee3efcccf8a

SHA512
209612e06aeb09751a67412aeb24702b5841a6b995127d2e2e395c4026223f422a438414cb67310922b05558b86a921a47b4a5c03ad54c3f0844e7a7dfb47cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c5e3d668-e172-46a9-9c9f-0913485e9f25\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
f2a8f24c8e419143b0cd93f81bf179d4

SHA1
1a9438f5ed45446f80069f4b6202fd85d1ada6fa

SHA256
2d17f016d5ee95819b472e1eee12a3d469e79472a83284525e8e496724d0e39a

SHA512
3991a8cbeae0696d5af5ee4ba0ba03e5584e46917b410eda79c91c8486366fe97c23e6ebd5e3596574b278cd0cbae46536d4ecf63bfe2d1258b06c7451038e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
b1dcc66f6e6a13d120f67467532cc1ba

SHA1
a651240e5a22e19dfa8b72bcdca5b783dd091f38

SHA256
575ac3b771338581cc139bcc033de751c39842df687ffa2e0adc6d76f7076084

SHA512
65f7a10200a16ab6e58209c5d524767598a346d4a0dbb1bc44038da94c5aa35c30a3a11e55fcbee49b9d618db7868895569fc48e2b0d98aa273366dceec58c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
21758e96de43d18fc746c69492423b5c

SHA1
d858dda0fa575f65e427dbdeaeafac83d1c4a768

SHA256
fd74332ed8aa8eda958018558bf8bd24705897b910a01c1e675c69bd4a0cc17c

SHA512
0aba79168d439123f02e5aeb6a67d37c28644fb255d6c3cedfac938fd410c10edd206ac188138b8a29e47762db61f01d3f3d8562d74c19da98cb281e52112d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
6ac8075bacb3574c69b44bcc04680c0c

SHA1
16fbff7be7b908c4fe4f3dbf1e4b0ee0d317cc5d

SHA256
f32da45769a3457ceaba55cffa3a0f4f10bcd84c4ab99463ea555e3b997f5007

SHA512
8616962770ae78a81d6e7f8a95c9173d5bbece43e3a0e0f8b75cb50d55164bfa187bf68708ff308c0fab81fe8e6b3c0ab61e54a6f1fffcf4b46fae542a994a45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
6b1a3cf366c69fa24aded74643eb95cc

SHA1
1190d28a33c39621e07c733dc2e52e3a0fe0b198

SHA256
bdb5f11b691a86adc9675e76f7a867ad5c545311ecb1aaf001d875c37642bcfa

SHA512
575740a438020eeea906d413fd35ae495d830d9f4b7775b2d742a2bb829b11fd6eb50bd6fd08865e8680a8f1f2a6bef661bbf48f0d4b26e4a367f6a656c11f47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
2a6a10e4513cfd14e158db02374b6327

SHA1
a1fdd60d250418e67c0b3c1115ac2f269bf71506

SHA256
a70cd035f8b50a32fbe95953147f75a711a2b26f49677c60ba7ae851c5be4bf9

SHA512
8905b3f5112c8c12af278f3ed9c8c7b57a1a35d327f7f1d89f3b437cad9b6f2b353b7309d9fc61ebb6584b36c47d54409e0d8c8fb078bd23b0abb931193ff506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
b9b1b8516d61345e32aa0630369e0d78

SHA1
7dff32c098f41750e8fd0497dc4f30ef8fad0d61

SHA256
c777b74f7e5190d2ac68ec41ac5e8df58c3a5cf8b0368aefdb288ac14c143c75

SHA512
5284cc46e34af965ca6d7c868c56c6ddde6e14e771b79818c951ed1f9ebabd2a8e60992e4ef95bfef6ba3fdcd11f94f72a4aeea99912054e7a83202506eb51a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
89c9b577ac8810cc8852e6438e7f2727

SHA1
ec5070d631a97bec6b1b9042941d0779889e5ea2

SHA256
f791b2b6d6a96eca5eef3e58f5f65cc9cd000988facdb1be932f1cc4de1e84da

SHA512
bbcd3f2fe763f817e0dbe78ed48df61ba11ef60a1bdd19e053d16715a5af3fcf9d7acc986a93dea0829f74d82a2761bf71b92400190e2d8c516a6f3e74d13d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
6971df23fe07127a97283b209bf84578

SHA1
f36a37e03eceabb7cb0b11da5d42f818d565b0ba

SHA256
7b66161912f69a53789743341e5265ff9435c0250b1487a27781670e099debbb

SHA512
2d862808b0a85c27ee606191c9c6a67eac3abde511b189a33e3cf684002e515ef1c11245cd7dd9f76ccd0b333575aeb66d31e011f4dc9aab907b4a3ae2e6420e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d3e5.TMP

Filesize
48B

MD5
3ee0d3b6d5695a1ead28a2c336cb0a33

SHA1
e11483bd8ded3e5a601084c7ceb4e2c181986d35

SHA256
2263ed9d31c688936321c4a99f4f6645d508af1e5d6cfd7392fd60ae3f0b1aa5

SHA512
7024b4f8c5de49212afa39ed1e4fab1fdb1fccfed566c47a98325f49d0ca093bcb58e2c053576897f1d5fc9f0d05c3157d5be5f1039ea2c37ef96e3670caa563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
d484413568dcaa948d801f93d6783e28

SHA1
6ea4d08c2339ae14af1264ea633e454d94232b28

SHA256
9f8d52c36871f32a440d4d9684b1e6052e3b2216dd32e6f935900ec581de5fd4

SHA512
2893f116d796674591378822aabf0e388d45181eab25cd4e79b81d98e50584a8b858ed750fc7f07d71f3ee363e94f291df333933e0727ea27d399b342f999d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
718c6eeb9df2b9e18439719700bb7dba

SHA1
393b96510f0fc67cda341e9c855c75a9f77c6212

SHA256
c4b501cf9e707d137a2649372e6e9c222249989da973c33c22066e70e432fc12

SHA512
9c614104ab979f3cfd5c6427fbeeb09a56bf6c3408956166eb9f59aae911871ac91173f35743eeebc75a4032e50c3b87a772634fe9b0892d2fdbfe0e0b924993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ed33184ec55e7bad445618e756e3d2e4

SHA1
dd2c528067f3399b03799382284b0b002aa45c60

SHA256
750cf5a316d10af31349a03740646760443f5076c60741d0dab86fb4557cd8c8

SHA512
bb4f08d53b73bce187ed0991d1c36ffea4b1b48f4b03794a5a52d043fc2f5f487eb1e671611873b6007e804949a3cd2ffcb0e90b8b478843f2593b4fd0b5e9b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca1453cc3483eb02032d3825c2ba34a1

SHA1
c124cadd53ed530cd1765f470438a824695e4ccb

SHA256
1291ba98b21a4d416e505900c230c0d61d055f659180e3891923b7295fc9e69a

SHA512
b6c215ec86f282273c9c1bf23e863a27213d9b60404201093b40c7fb60db89037f3d566427d6dfb9f5ee186530902b679d8e473b062e6eb645fb2b74d85f6005

Download Submit
C:\Users\Admin\AppData\Local\Temp\opus.dll

Filesize
332KB

MD5
1fc04b8bb4896745163df806695ee193

SHA1
39174ce2fca9a3e86bb7a5686037bc42f2572de1

SHA256
3f2b2fd440fdd84288dadfc63e37a4bc7ea0aae26889ab0d4a5ef6148f44ce14

SHA512
3ff18bdd364f27e54ffbf2d1af53e3500ec57e7e8fa14185f7fb1ef6639d69ac6253543b9e2155ade45ca5bcd567e94334f1ee7ad0a7ff28194168dc49883261

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe

Filesize
839KB

MD5
91ef82e1af220a239031e0552f47a117

SHA1
68781239f71c5adb0d729b98cbcbe31ba5f25524

SHA256
803d9688b31a4220400fe032015ec070b3ec42a7e5c075fab978cccf8dbe23cd

SHA512
c23d7315c4d355849353a72b113eb32c5b3cf10ff4edac141531856b55609912440572b813c64d8e387895cbb7e25b7a4d5da684a6c210a139a2254e80d77a25

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\Orcus.Administration.exe

Filesize
16.2MB

MD5
a6347e4e194adb6d2a3fae52598d8cdd

SHA1
aa06c496c20d6e04142d4a5205a032680a452a0d

SHA256
911e3e95efddbae9d1c2f4b04027567c76823116755097b5868b7241c7e30cbc

SHA512
2ee24604c0edbc09096e2344ca6c1f74b1067b9aff7f077d0b4e42cd8f51dd1116e98016e34f0a1d951fcdbc8bfed33b1709a9692ba95b3ea3cd84d9ce080922

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\Orcus.Administration.exe.config

Filesize
1KB

MD5
2846ec087e67923c130a5b875193c893

SHA1
ab1049f2531941cb98e99e5f83e8fb6b5be3a7f4

SHA256
148dc241bfa25e5fda9ebef2d315aa95121f9468da29dc167573f32f14733d08

SHA512
a332471ee3d01a13d6f7fd3516ce58e43ce7f6d7dbc0f6b8cc90b26d1be13b2b5b39ce76c29be753edbf5146eca92c02de2746f251918ac12a1cf103df1899de

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Exceptionless.Extras.dll

Filesize
71KB

MD5
d3fcd5038079ef42e23ed39a86af5a31

SHA1
3977309df5b3ddc0218a800ee463ddcbcae7503e

SHA256
9d4ab0418d94d3c3d7025ecc1c70ce1762ee12aaa4d35666c2dc7887df53a537

SHA512
8535e4b5b7b61cf31fe69bd43eb2ba4c2a248a2f2a6efcf9b1ffc9cf4d39b67dcb687d45964054b3900f5aa21662b4acc91302f02e99e819ac6f5827a0d493d0

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Exceptionless.Portable.dll

Filesize
678KB

MD5
6aba9f00d64371b940eedc21804ea9eb

SHA1
5fb0e520a23c780474b0866218c61ff55d083b3f

SHA256
22c949720dacd2dc19b7744185b18faf53dc18199c36af44158257a08ce7f3fd

SHA512
9166ff3cfd7adc334f3a98f4a40736c178a1c793f6ca264722bd1b962a3d059d88035eee1f45aab2b45a8692a13ef50c8e762c4c8600937b263fd7c2703185c0

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\FluentCommandLineParser.dll

Filesize
43KB

MD5
9b5e37f89268ccce0e098222004093ad

SHA1
30b12174abda6a420b2cc152b5c682ff8f106c37

SHA256
fe068b6f15a5423f86558927dd22ec35070c041db9cde1ecade0590d93ca5285

SHA512
23e8cbaa6103f5a76729ee8470b5b208d67be22c9b9fa78340055ac8ded04dc6147c8c50cde96f7c10b111f81cab3e5504227ac5b8f1a616c1a1384c6350257f

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\MahApps.Metro.dll

Filesize
918KB

MD5
fb1e8eee84791cc015e043ab0ce32bba

SHA1
42fb789011213635a7d022ba4fd5461a0d9a134d

SHA256
0de72da4bc2d16d39c30368af880d754fa0bd9745897652ba50213e589d265c5

SHA512
748af415c875cd5d44f305cf58060e7e66ef2ef041b6e86e3a76287a51af63116096eaed0877dc48c17da6594ad0c8dbf0ecadecb763dd469be8b6cc1d02d4a0

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Mono.Cecil.dll

Filesize
274KB

MD5
6d6292bc8e698e53e69556add6f62442

SHA1
fab26eb07adab421797689da27ad754aa1c31810

SHA256
0f6465ce57a0cbabc37013c8e3c9f110672de1c127b6192177d59eb1c7809772

SHA512
f77c995857bf3c62bd87cce4246d9792d388af33664fbabf05bfcf574ae9332c45013697be7f698bff6cd33b02573abcbeae172b53c75979339e01123c61ae32

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\NLog.dll

Filesize
517KB

MD5
27c2b96dfbebba578638588d2c95705f

SHA1
6223920526982da59a93ccb2d733e9bdbb1afbaf

SHA256
a74414ee5a23d73d879c216d9cfd96a9a8ad048773fe689d8a8b3022c9869cdf

SHA512
aa90ef4fef936a43c3413c90427668b7956742bb88eb2693d8dc23654952997771e702f5c0b8ffa04e8f0ef8e16809d8bb3ac1f007bc9989b039e78a1d2a6358

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Newtonsoft.Json.dll

Filesize
510KB

MD5
c3c04754418382f505cafc18d64427f5

SHA1
cac5e36dc498d6bb16170020be021ff5bd18a9e2

SHA256
df8ec2e0245829ddec5b79f1918c3ae3a3fa540a5a0e3c410e2b6ef0bebc7927

SHA512
bda5efd0f69a9c7198841e5d31744fa2bebb05cedb1e2846a0d2dbce6c3193da69c181be1116f38cd5f3d61b441567b1da2c844522184323e3d429294aa91ab5

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Orcus.Administration.Licensing.dll

Filesize
80KB

MD5
70e207da89961cd32217eabbe3ac0791

SHA1
305ba309e762a128ae098e5bf0241ba71f3a331e

SHA256
83f968c6682b0e52b217daa6aa3da21be6967aa194a14631f43cc76c11a142e9

SHA512
8d9de9a9b3ad265a1df7bd7ab790db639d6ef4b871275a5b2fbb72f9b324cc3158d2073de2de78692fa7ffe64e78e31e7d7f75cb3b50c0d6513da21094bad075

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Orcus.Administration.Plugins.dll

Filesize
34KB

MD5
358e21f82feabac03af75599b09532bd

SHA1
b6523b40151fa7090d1a2c44f2b7335170b2d7aa

SHA256
ba011053d673579f781de553994366683d7ea57410ae8d10d9823387ee94b918

SHA512
7334c3b0dcddd321f9fa0536b5000151a4b65f7da5b41e1f70009af7cfdaee70c44d07ce4d5f7eded97d30a89b9c1bb71a18e39fc6243b0fc07a5e3ee05dd1d9

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Orcus.Plugins.dll

Filesize
21KB

MD5
88e74301f491db06cf075502629b6e56

SHA1
21e970cd1a672fc00eba203ec52a7e4bcb972420

SHA256
e33b1f7ef345a2fde88b2f70e24f1df739c4db0d33f4c2a6fdbacbc4e4190e91

SHA512
0efd79562d68912d6526d570be6a9334cbc79df0c68c105b7287ff6f36b5b6c85a7eb99ba8d6b057e86333c0e8909fe50fe49fe42f2c717f10801a88609c4ecd

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Orcus.Shared.Utilities.dll

Filesize
25KB

MD5
155e691e9ff9b79b713836b5d469e3b9

SHA1
17988767d56448bfde33c20d1cd46089ce1f2852

SHA256
680a6a746f6961b6df5495d91c44bb4007c62090dd76948c45640ed01c0bd56e

SHA512
e8ad235a5a847a9da3bfc476e44f3cbf7d5c400e6b63c2ce3fce15d2ce7c39a0ae5b9cb13680a9ecc4c36c529f865fdc3351a1dcee37a36902d132f829b908a7

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Orcus.Shared.dll

Filesize
282KB

MD5
d5d297629e1b1e77758f4221d1a5bf66

SHA1
5a56ec678d97ea260dbd40825cd1148332a8e06a

SHA256
c046865c41a0880ccd223c57e148a1083e7e2fe4da647fa15a04a3dc182da5ae

SHA512
8cea7bbea5734f9a6054314235be4047fa51408b51e171f94f7a727520efd13e47f1fe0476d2cabcf946d51a6c17ab3cba4f2eb4263e6ff6891e3024eb9fccc7

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Sorzus.Wpf.Toolkit.dll

Filesize
43KB

MD5
efc2bbca9bfe174475d17e62ea0f5b4d

SHA1
3d74ba1d65245fe86cbca4cff525856e9b1755a1

SHA256
9f025d34cb7dc817df9f7f722c14eff6f2d95946ef24c486c7063d8ce9e0236f

SHA512
575a9700ea8d4fa1d470632c3654425c816b82c7a5f60c8c9787cc699961d95b2eee82ebedceaa77ec17a96329958235b3a94b6ee868e3a900bcae770506ef23

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\System.Windows.Interactivity.dll

Filesize
54KB

MD5
580244bc805220253a87196913eb3e5e

SHA1
ce6c4c18cf638f980905b9cb6710ee1fa73bb397

SHA256
93fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf

SHA512
2666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\Xceed.Wpf.Toolkit.dll

Filesize
1007KB

MD5
96a320c552ce1152cd674895ffad9f10

SHA1
7a345edab598a794d71d03cd36b78e1ce683e5c5

SHA256
fcadc89d8b2154008f96073da5562575c054e5520f8cd1ff5e292ffe7e67efd7

SHA512
465032415e03c4eb27eb07c157139962d1a3f04619b4bc989bbc1455a62fb5491e7915ac5df9be83c3b17f7287086ab0de0d4caf0cb161f857f3eff05ff776dc

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\libraries\nUpdate.dll

Filesize
2.6MB

MD5
253ba7f0427e3f8e032b97496a019a24

SHA1
62793783943b04d8836746bb452145722cf63001

SHA256
814eb85113211fa90efe952f35d06e537f01bf38febca48e2c0cef02ebdb1877

SHA512
29f848f4293454a0103197cd3bb59e364df099b7a26f926673b30132ffe3d15b505fbfc3e0391482d9cd9ed53efd0f3193d0cdf83e0fb59ce3e27de878b83585

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\ApplicationAudioPack.orcplg

Filesize
628KB

MD5
b8cd6b3141a11fa161b2039ded9dc0f1

SHA1
bdf56b2b8b84940699034a2afd9be6fca554d905

SHA256
c82a13255716c73b3ed9d89c48eb000d556e9690f4f830d444ffb64041f7e813

SHA512
deba05e0c5e077aba1b17985863abdbe115d7f9476a2902d6ddbed081b7632b79510601561276354516350553913d162333842a1e896af8af5b1dd5bc2c00b4f

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\BSoDProtection.orcplg

Filesize
14KB

MD5
727dbdbe573b1ef41a2c2457d9d1b9a4

SHA1
b65d0ead80c87f7e4b6543c362c257185d5e33c3

SHA256
fe204d16f31a6b210343be7e52279f8abedf8587206503daa6f2c8f6224679f2

SHA512
0b1530ca35d6772da20ef7018bd1f81554d9e2f1b9f30ea12db5c40f7f800712c88caa77b3df29e503ebd40b33d06cc16125eadab7804f974d659b2f6c577681

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\BuildPumper.orcplg

Filesize
54KB

MD5
595efdf47d3a392ec489defac02ad7cb

SHA1
40741f2a47c5f1f210f860c10fac7bedc4eb058d

SHA256
9fac7662c10a44f9870f42e1a5d407b31b0d7e4428b7ca95c28bc705625d0613

SHA512
a7c5bde085b6d9465cf01798631381e3eb73b9b93db8d06bb7ab7c759bef1a92fe8174b6faf2bfcc7b300d0c242bab2adc90c488ab36d257bbc34d56e8d41bcf

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\DisableWebcamLights.orcplg

Filesize
21KB

MD5
5f32cd5a2c08ec5504de906c6f598281

SHA1
7adafa9de45c29b0e58c7df98f1c756ebf05dcb2

SHA256
f54ef6da320b5f66f3562e44a36bf0cea3848d452ebe2b53f7f5dbb28cd2b61b

SHA512
f3f9affc5157a1ac09eea0f2075184d5649dcd8e49c888ead27e633faf543e30d4085997c0af0942398f64b3ef2a62a8a37028efcfa30b77f491e2d34fe34b72

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\EILoTIRiXAudioPack.orcplg

Filesize
2.8MB

MD5
31aafa3933fdab7683e889ec1038ad35

SHA1
d11f7fa55e2cf75ebbc6487468ed4b0674f1111d

SHA256
24aa9269afbac24251495bd0c86538b814089cdaa0aa77a2ef653d31dbc33bcd

SHA512
e63ef239f6f58692f8b5c1fe4dd60e91f2892da696b8797437e4cbc6b7bddfeb0dbaaccee0be0185e50e05162b5cc141ee14da9aa153f26252bc7461d8da2da1

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\ExceptionTest.orcplg

Filesize
19KB

MD5
a5b3e031c0d6b20817422beb12bfc78f

SHA1
e9a909e13889a2e6688782d3a290ac375ba4b528

SHA256
c66c8d3ae5f3af64ee34da2f7df88055e314fa1e9254aa9e2425e1f527db9e81

SHA512
f96ad64a771767bb626de49786f5adc4e94a56fa10f68588b9af06ae33dc2f73fade1fc9758ecbefd56a94a6a6221392addb6b9a2b1295f8f39940d7e760a509

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\ExtensionSpoofer.orcplg

Filesize
20KB

MD5
2e27ddbcd452e61fe204dc593e1846ff

SHA1
005a864ba1c68802218cfba31756a62193a3407e

SHA256
ef736367bc542ca05bc3ca14455934b412a3f88564d022bb14c59f82d0433ba2

SHA512
4bc127d9e21667b113df85f4beda96c00d1a5933c9f25d65ec6084b7efdec58500404eb394f648a5cfbbf50c4e32af0306686f978a09ad0f6a3212427b0ffcff

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\GamerView.orcplg

Filesize
405KB

MD5
8b6269e7ca2180ffd4777552f2335760

SHA1
c809c7c37db0d73662f1034d6dfea63a7db0b229

SHA256
8c0d48a0383af350f80c2dadd34e67bb8c0e2b4186871e59178715f0c4aa4d54

SHA512
37c4323b10d663cad2c0869000dcfd47cc61a74c8e4fe2aeb5029e3d64a3301b3a32b32177aae382ecc3c2e68dc677ee362563eb305ac5003a688017db1d327f

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\MicrophoneRecorder.orcplg

Filesize
399KB

MD5
152544f1ffd1a61aadeb23fdf4078b0d

SHA1
f3a65b9def674f4e139dcd92766e9df7280188b1

SHA256
bac443cf632829f3a946d79f35fe75fa6648949b7cc9b51ec7197691a3b84eee

SHA512
520da08cec73947a8cb66d2e4e70c3e5f2a5ab230d8cae95f9ea60961878166151ab5053fbfc11a2441680bad7b21e7c1222ff89a68c7e1d5a06d248b0c16388

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\NotificationCenter.orcplg

Filesize
39KB

MD5
307e0f115911e72fb3515cd3e974b802

SHA1
23c392e92714df39f50411abc74210f973f13891

SHA256
e4b01417828da0489b97f1a6e3173b501cc510a1c14e5536f65b6f5929dc24e1

SHA512
cd8c9eb1068a7c0ca1c015575a71efaeb4a2a51f00003f011e6a00e862bf11d8f51632f97d2a351d17ad707b35a2b01d63beaea45176f3a87b28450a211e456d

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\OrcusPatcher.orcplg

Filesize
28KB

MD5
d73970251dd27aab5d6bfb79b98e672f

SHA1
48e90e2224b492d4b3356b669614806f9bbaeff7

SHA256
3051a1f1cd8c2984d56656fc7cda2bc63b57735dcf1a56c39a1d77e6196d3d38

SHA512
5e6e7b40d5cc93aa12782974a6e19c5d8c28a05dc32195b0d1f6ff28f976bdfb79075aa8cc3cd22c760ba5ce611f8dfc0f99ff0509545510fd21da649cdab331

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\Screamer.orcplg

Filesize
1.4MB

MD5
c4fa0302349ea02d1a86e8c3538441a4

SHA1
830cd230e1b53cc0b6eda814ddd8b1851b94e475

SHA256
2c5b663d664e3e5fe58a27bf5148a35770f096005df2069af859fb2d4ce6959b

SHA512
cf9fa52e7bf8f239b746d6a3cc95315dca89e00029e8a32c0b6372b11386a6805b7a47f09e56c85f24c8e2329e4cf54fb004a7509303b926ddbe27022d9b6bfc

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\plugins\ServerStressTest.orcplg

Filesize
58KB

MD5
4cec7a3155b93a82f1171e1b4a27ba44

SHA1
d3279fe76c74f30ff4a44e62383e2f67884e4fd9

SHA256
a1c433464b65db673ce7228aba3788a16f850cf4813e389f989b6fe04f1fc1af

SHA512
6e9efddfdcb68c0364605042e061845f3df6971328b12c6284e818549c54ddabd0fc7581ed5fe88aed239b58c5f24c6814681fbe3b70957e8f5134c6d09b234b

Download Submit
C:\Users\Admin\Desktop\OrcusRAT-main\settings.json

Filesize
897B

MD5
9ef365494bc362da1a6ddf86acc48b7a

SHA1
e466a6fcd0e8bcfe9a4657e113d81be7a70092e8

SHA256
6f9dd8f4ce48574ce886f3ebd30cead17aafcab6defeccba45ff1348ffa6c8a7

SHA512
9628a120f96d29820a8ee9a39f11579bb2edf0504a76169bbaddba2692fd54a007d8b57f73633c3bca39e32c132cb1ded0374851f5ff5b6107f8d2642ccb2bab

Download Submit
memory/872-1064-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/872-1050-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/872-1039-0x0000000009950000-0x0000000009984000-memory.dmp

Filesize
208KB

Download
memory/3336-929-0x0000000006300000-0x000000000633C000-memory.dmp

Filesize
240KB

Download
memory/3336-935-0x00000000096F0000-0x0000000009986000-memory.dmp

Filesize
2.6MB

Download
memory/3336-928-0x0000000006240000-0x000000000628C000-memory.dmp

Filesize
304KB

Download
memory/3336-926-0x0000000006A80000-0x0000000006FAC000-memory.dmp

Filesize
5.2MB

Download
memory/3336-925-0x0000000006380000-0x0000000006542000-memory.dmp

Filesize
1.8MB

Download
memory/3336-930-0x00000000062D0000-0x00000000062F1000-memory.dmp

Filesize
132KB

Download
memory/3336-934-0x00000000071B0000-0x00000000071BA000-memory.dmp

Filesize
40KB

Download
memory/3336-927-0x00000000061C0000-0x00000000061F0000-memory.dmp

Filesize
192KB

Download
memory/3336-938-0x000000000BCC0000-0x000000000BD3C000-memory.dmp

Filesize
496KB

Download
memory/3336-939-0x000000000A8D0000-0x000000000A8DC000-memory.dmp

Filesize
48KB

Download
memory/3336-940-0x000000000BB70000-0x000000000BB7A000-memory.dmp

Filesize
40KB

Download
memory/3336-941-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/3336-918-0x00000000006D0000-0x0000000000A22000-memory.dmp

Filesize
3.3MB

Download
memory/3336-923-0x00000000056C0000-0x00000000056EC000-memory.dmp

Filesize
176KB

Download
memory/3336-924-0x0000000005890000-0x00000000058DC000-memory.dmp

Filesize
304KB

Download
memory/3572-951-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4140-251-0x0000000010BA0000-0x0000000010C52000-memory.dmp

Filesize
712KB

Download
memory/4140-309-0x0000000006B80000-0x0000000006B90000-memory.dmp

Filesize
64KB

Download
memory/4140-308-0x0000000011710000-0x000000001171E000-memory.dmp

Filesize
56KB

Download
memory/4140-307-0x0000000011740000-0x0000000011778000-memory.dmp

Filesize
224KB

Download
memory/4140-306-0x000000000BDE0000-0x000000000BDE8000-memory.dmp

Filesize
32KB

Download
memory/4140-305-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/4140-304-0x000000000B9D0000-0x000000000B9D8000-memory.dmp

Filesize
32KB

Download
memory/4140-303-0x0000000009420000-0x0000000009430000-memory.dmp

Filesize
64KB

Download
memory/4140-301-0x0000000009450000-0x000000000949C000-memory.dmp

Filesize
304KB

Download
memory/4140-297-0x00000000088F0000-0x00000000088F8000-memory.dmp

Filesize
32KB

Download
memory/4140-296-0x00000000088B0000-0x00000000088B8000-memory.dmp

Filesize
32KB

Download
memory/4140-295-0x0000000008E30000-0x00000000093D4000-memory.dmp

Filesize
5.6MB

Download
memory/4140-294-0x0000000008490000-0x00000000084A2000-memory.dmp

Filesize
72KB

Download
memory/4140-290-0x0000000008590000-0x00000000085DA000-memory.dmp

Filesize
296KB

Download
memory/4140-292-0x0000000008470000-0x0000000008492000-memory.dmp

Filesize
136KB

Download
memory/4140-286-0x0000000008450000-0x0000000008458000-memory.dmp

Filesize
32KB

Download
memory/4140-284-0x00000000080E0000-0x00000000080F2000-memory.dmp

Filesize
72KB

Download
memory/4140-277-0x00000000080D0000-0x00000000080DC000-memory.dmp

Filesize
48KB

Download
memory/4140-273-0x00000000084F0000-0x0000000008582000-memory.dmp

Filesize
584KB

Download
memory/4140-272-0x00000000083F0000-0x0000000008454000-memory.dmp

Filesize
400KB

Download
memory/4140-270-0x000000007485E000-0x000000007485F000-memory.dmp

Filesize
4KB

Download
memory/4140-265-0x0000000008070000-0x0000000008084000-memory.dmp

Filesize
80KB

Download
memory/4140-269-0x00000000080A0000-0x00000000080B2000-memory.dmp

Filesize
72KB

Download
memory/4140-263-0x0000000008060000-0x000000000806A000-memory.dmp

Filesize
40KB

Download
memory/4140-261-0x0000000007F10000-0x0000000007F18000-memory.dmp

Filesize
32KB

Download
memory/4140-259-0x0000000007BD0000-0x0000000007F12000-memory.dmp

Filesize
3.3MB

Download
memory/4140-255-0x000000000F740000-0x000000000F74A000-memory.dmp

Filesize
40KB

Download
memory/4140-257-0x0000000010FD0000-0x0000000010FD8000-memory.dmp

Filesize
32KB

Download
memory/4140-253-0x000000000F710000-0x000000000F718000-memory.dmp

Filesize
32KB

Download
memory/4140-249-0x0000000010A80000-0x0000000010A92000-memory.dmp

Filesize
72KB

Download
memory/4140-248-0x000000000F720000-0x000000000F72A000-memory.dmp

Filesize
40KB

Download
memory/4140-244-0x0000000010B10000-0x0000000010B98000-memory.dmp

Filesize
544KB

Download
memory/4140-240-0x000000000F6F0000-0x000000000F6FE000-memory.dmp

Filesize
56KB

Download
memory/4140-236-0x000000000C750000-0x000000000CAA4000-memory.dmp

Filesize
3.3MB

Download
memory/4140-235-0x000000000C680000-0x000000000C6A2000-memory.dmp

Filesize
136KB

Download
memory/4140-233-0x000000000C6C0000-0x000000000C746000-memory.dmp

Filesize
536KB

Download
memory/4140-229-0x000000000C610000-0x000000000C622000-memory.dmp

Filesize
72KB

Download
memory/4140-225-0x000000000C530000-0x000000000C548000-memory.dmp

Filesize
96KB

Download
memory/4140-221-0x00000000067A0000-0x00000000067A6000-memory.dmp

Filesize
24KB

Download
memory/4140-220-0x00000000067D0000-0x00000000067EC000-memory.dmp

Filesize
112KB

Download
memory/4140-216-0x00000000067B0000-0x00000000067CC000-memory.dmp

Filesize
112KB

Download
memory/4140-215-0x0000000006890000-0x0000000006992000-memory.dmp

Filesize
1.0MB

Download
memory/4140-211-0x00000000062A0000-0x000000000638C000-memory.dmp

Filesize
944KB

Download
memory/4140-207-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/4140-206-0x00000000063A0000-0x0000000006636000-memory.dmp

Filesize
2.6MB

Download
memory/4140-202-0x0000000005DD0000-0x0000000005E80000-memory.dmp

Filesize
704KB

Download
memory/4140-1063-0x0000000005CB0000-0x0000000005CC4000-memory.dmp

Filesize
80KB

Download
memory/4140-198-0x0000000000390000-0x00000000013CE000-memory.dmp

Filesize
16.2MB

Download
memory/4140-197-0x000000007485E000-0x000000007485F000-memory.dmp

Filesize
4KB

Download
memory/4140-1143-0x0000000006FC0000-0x0000000006FE0000-memory.dmp

Filesize
128KB

Download
memory/4140-1148-0x0000000001E10000-0x0000000001E38000-memory.dmp

Filesize
160KB

Download
memory/4140-1169-0x00000000077F0000-0x0000000007870000-memory.dmp

Filesize
512KB

Download
memory/4140-1170-0x0000000017350000-0x0000000017968000-memory.dmp

Filesize
6.1MB

Download
memory/4140-1180-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/4504-967-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download