Malware Analysis Report

2025-03-15 06:43

Sample ID 250124-n2e7haylfm
Target fall.exe
SHA256 9e1c62eb882475a97643802f9b4ee456837abff20b9c23b7805504b6fa99b5e6
Tags
orcus
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9e1c62eb882475a97643802f9b4ee456837abff20b9c23b7805504b6fa99b5e6

Threat Level: Known bad

The file fall.exe was found to be: Known bad.

Malicious Activity Summary

orcus

Orcus main payload

Orcurs Rat Executable

Orcus family

Loads dropped DLL

Drops desktop.ini file(s)

Drops file in Windows directory

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 11:53

Signatures

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 11:53

Reported

2025-01-24 11:56

Platform

win7-20241010-en

Max time kernel

145s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fall.exe"

Signatures

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fall.exe

"C:\Users\Admin\AppData\Local\Temp\fall.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u_tcprpg.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7743.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7742.tmp"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MergeProtect.mpv2"

Network

Country Destination Domain Proto
NL 195.88.218.126:10134 tcp

Files

memory/2396-0-0x000007FEF5D9E000-0x000007FEF5D9F000-memory.dmp

memory/2396-1-0x00000000022C0000-0x000000000231C000-memory.dmp

memory/2396-2-0x0000000000400000-0x000000000040E000-memory.dmp

memory/2396-3-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

memory/2396-4-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\u_tcprpg.cmdline

MD5 4fff779ba0c11bfe8465736aa8253fc4
SHA1 b8364383eccbc39894d26da136b4c44be14e2a3b
SHA256 ea28be9514c4e5ddeca811e2378672c50b5096f6c89d499f989706f3f498ae58
SHA512 5756d99d698a55d1635eb314ebcc66e1d28241dbabff0f49c56c7f4563f62f934db5666c1c91c0cbad043445108a2377f40cf2bac1ed5c41290f4974a1f4ef10

\??\c:\Users\Admin\AppData\Local\Temp\u_tcprpg.0.cs

MD5 6011503497b1b9250a05debf9690e52c
SHA1 897aea61e9bffc82d7031f1b3da12fb83efc6d82
SHA256 08f42b8d57bb61bc8f9628c8a80953b06ca4149d50108083fca6dc26bdd49434
SHA512 604c33e82e8b5bb5c54389c2899c81e5482a06e69db08268173a5b4574327ee5de656d312011d07e50a2e398a4c9b0cd79029013f76e05e18cf67ce5a916ffd9

\??\c:\Users\Admin\AppData\Local\Temp\CSC7742.tmp

MD5 35bce98dc2cb0665b85dbad4ec3c0a52
SHA1 9fa326f456493d6844535831923960fae3810112
SHA256 0ba6d1ff8aa0b958d801daf0231ac324ae8806d5618c1bba00590e480bab10c2
SHA512 1feb917d7654d7cb6c084f9834f9f9ae3c143e7501f12b374a0b336636fc1545660eacdebbfa5fd9e8cffe6d7a4c4b1049ee8355e205f772db6810e6b8f50f5e

C:\Users\Admin\AppData\Local\Temp\RES7743.tmp

MD5 5a8581b4799410c70c44654f2e81d936
SHA1 edf5771f850722f4489bab032e8a710ad8174d28
SHA256 bc6c418115edcfb442a491e75c6267056c4a0bd45034430689b0a62ca834707c
SHA512 20b43eea327aa0ff69985bfef0bbbc038019a7d31868e2fbf97e8acc440c2bda93df93f0f98a79222de6f2e9ff1c8072b8b2dd7b7d923bcf82e12425055c6423

memory/2168-12-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

memory/2396-19-0x000000001AEB0000-0x000000001AEC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u_tcprpg.dll

MD5 4f1883ee245d7e10a7b9aeb3d9a52d29
SHA1 4d0a57faf621a9c0e4db3889c6fb88e4ebaa37a2
SHA256 1a3da9e2f7f8f721b45d4998008ec5d0567604c1de6dce6198659f75e825b55e
SHA512 915487d861fa8ff207f576e81ee014ff9331b49f1f44be549406b4b45c9bb98b8acf0b72fd23baab9aaee19f909e33fbc913da1fd01a904623ceb4ec64d11f6d

memory/2168-17-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

memory/2396-21-0x0000000000420000-0x0000000000432000-memory.dmp

memory/2396-22-0x0000000000D50000-0x0000000000D68000-memory.dmp

memory/2396-23-0x0000000000430000-0x0000000000440000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab8345.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2396-40-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

memory/2396-41-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

memory/2396-42-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

memory/2396-43-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

memory/2396-44-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

memory/3008-53-0x000007FEF64C0000-0x000007FEF64F4000-memory.dmp

memory/3008-52-0x000000013F170000-0x000000013F268000-memory.dmp

memory/3008-55-0x000007FEFAEB0000-0x000007FEFAEC8000-memory.dmp

memory/3008-54-0x000007FEEEC70000-0x000007FEEEF26000-memory.dmp

memory/3008-60-0x000007FEF1BB0000-0x000007FEF1BCD000-memory.dmp

memory/3008-59-0x000007FEF1BD0000-0x000007FEF1BE1000-memory.dmp

memory/3008-58-0x000007FEF6960000-0x000007FEF6977000-memory.dmp

memory/3008-57-0x000007FEF6F80000-0x000007FEF6F91000-memory.dmp

memory/3008-56-0x000007FEF7310000-0x000007FEF7327000-memory.dmp

memory/3008-62-0x000007FEF1B90000-0x000007FEF1BA1000-memory.dmp

memory/3008-63-0x000007FEF1B40000-0x000007FEF1B81000-memory.dmp

memory/3008-64-0x000007FEF1B10000-0x000007FEF1B31000-memory.dmp

memory/3008-61-0x000007FEEE9B0000-0x000007FEEEBBB000-memory.dmp

memory/3008-66-0x000007FEF1AF0000-0x000007FEF1B08000-memory.dmp

memory/3008-69-0x000007FEF1A90000-0x000007FEF1AA1000-memory.dmp

memory/3008-74-0x000007FEF1640000-0x000007FEF16A7000-memory.dmp

memory/3008-65-0x000007FEEAD60000-0x000007FEEBE10000-memory.dmp

memory/3008-73-0x000007FEF1A00000-0x000007FEF1A30000-memory.dmp

memory/3008-72-0x000007FEF1A30000-0x000007FEF1A48000-memory.dmp

memory/3008-71-0x000007FEF1A50000-0x000007FEF1A61000-memory.dmp

memory/3008-70-0x000007FEF1A70000-0x000007FEF1A8B000-memory.dmp

memory/3008-68-0x000007FEF1AB0000-0x000007FEF1AC1000-memory.dmp

memory/3008-67-0x000007FEF1AD0000-0x000007FEF1AE1000-memory.dmp

memory/3008-75-0x000007FEF15C0000-0x000007FEF163C000-memory.dmp

memory/3008-76-0x000007FEF15A0000-0x000007FEF15B1000-memory.dmp

memory/3008-79-0x000007FEEF780000-0x000007FEEF7A4000-memory.dmp

memory/3008-80-0x000007FEF1580000-0x000007FEF1598000-memory.dmp

memory/3008-78-0x000007FEEFA40000-0x000007FEEFA68000-memory.dmp

memory/3008-77-0x000007FEEFA70000-0x000007FEEFAC7000-memory.dmp

memory/3008-81-0x000007FEEF750000-0x000007FEEF773000-memory.dmp

memory/3008-82-0x000007FEEF730000-0x000007FEEF741000-memory.dmp

memory/3008-83-0x000007FEEF710000-0x000007FEEF722000-memory.dmp

memory/3008-84-0x000007FEEF6E0000-0x000007FEEF701000-memory.dmp

memory/3008-85-0x000007FEEF5B0000-0x000007FEEF5C3000-memory.dmp

memory/3008-86-0x000007FEE8E30000-0x000007FEE8E51000-memory.dmp

memory/3008-87-0x000007FEE8DF0000-0x000007FEE8E07000-memory.dmp

memory/3008-88-0x000007FEF75A0000-0x000007FEF75B0000-memory.dmp

memory/3008-89-0x000007FEE8DC0000-0x000007FEE8DEF000-memory.dmp

memory/3008-90-0x000007FEE8DA0000-0x000007FEE8DB1000-memory.dmp

memory/3008-91-0x000007FEE8D80000-0x000007FEE8D96000-memory.dmp

memory/3008-92-0x000007FEE8CB0000-0x000007FEE8D75000-memory.dmp

memory/3008-93-0x000007FEE8C60000-0x000007FEE8CA2000-memory.dmp

memory/3008-94-0x000007FEE8BF0000-0x000007FEE8C52000-memory.dmp

memory/3008-95-0x000007FEE8B80000-0x000007FEE8BED000-memory.dmp

memory/3008-96-0x000007FEE8A00000-0x000007FEE8B80000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 11:53

Reported

2025-01-24 11:55

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fall.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fall.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\fall.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\fall.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\fall.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\fall.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\fall.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fall.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fall.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fall.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fall.exe

"C:\Users\Admin\AppData\Local\Temp\fall.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vlybkrxm.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89D2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC89D1.tmp"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ResolveAdd.docx" /o ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 145.136.73.23.in-addr.arpa udp
NL 195.88.218.126:10134 tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 188.77.23.2.in-addr.arpa udp
US 8.8.8.8:53 126.218.88.195.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 78.239.69.13.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 2.17.106.154:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 154.106.17.2.in-addr.arpa udp
US 8.8.8.8:53 235.137.73.23.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp

Files

memory/3024-0-0x00007FFC6E965000-0x00007FFC6E966000-memory.dmp

memory/3024-1-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-2-0x000000001BCE0000-0x000000001BD3C000-memory.dmp

memory/3024-5-0x000000001BEC0000-0x000000001BECE000-memory.dmp

memory/3024-6-0x000000001C3E0000-0x000000001C8AE000-memory.dmp

memory/3024-7-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-8-0x000000001C950000-0x000000001C9EC000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\vlybkrxm.cmdline

MD5 1afe58f013e7d89f158da65e10d00c21
SHA1 03f29c59be8a639051244ec6dfe6fcfecf7c9464
SHA256 62a61e70e2fa83a8d43d6963440860164d8e2afe29a08ec773d47a7e69218c69
SHA512 72c91bc55abeb05c654dd497f5d8aecc85389cc9b644344d23ebba5cadbafffb55ab903cc28bd11dea0e89f09b57ab759a9927f710f8457e6e753d561ca45fe8

\??\c:\Users\Admin\AppData\Local\Temp\vlybkrxm.0.cs

MD5 520cd0375773df05fc12f04a9b6cc8f3
SHA1 9e5c0a7e64f00c543fa5ea643bff1d93f7d651c0
SHA256 da06aac46e36562f421341c7001b572f544d0e9dde4458ba399def9137207e99
SHA512 80993d6a473e61bec8096d6c8b996bfa085408077ad49418a111c6573dae92feff70199804b7274093d0c3b20a535c539e8c991ef2ee29b78858e94632038676

memory/1620-14-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC89D1.tmp

MD5 95306a919e0047a18b59cfacd4f1a057
SHA1 f4c944c80df8a6ae5767dbcd24d30310f03d0974
SHA256 66ce47adaa6018845c7665312390bf1c88d1ecb9027e3e94a329094236213055
SHA512 255438ee9b8431558b1ca50703eb571082fc4dcec14fa6c4162759cce5120b29f1c5476a4a5fac8394d6d1357e0ab4bb884274ad38651e406aecbdc8056779d6

C:\Users\Admin\AppData\Local\Temp\RES89D2.tmp

MD5 54da8995b9e3c20ad0e0b6f83c41b4e2
SHA1 16c73efec9894f1a95c42e42ab5dc3d7239acbf1
SHA256 4b73c19e1d22bc624895671207260bcc3ab09cdf088c33fbbb84009630d676a1
SHA512 00a5d6e45f682ce8f702f1ae6360bde8510d98085cf991323056c5ea067a6fc81f22ce1ce306071dda58e0f0e091d32499b56f048803c488357c7606528d5852

memory/1620-21-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vlybkrxm.dll

MD5 662c6cc3c6cf7ffce55d5427afeaa2fb
SHA1 a11e5e58b2e1585f1fa2f8a50007e295357fae8b
SHA256 1b1565c89f97b446739b38d4b802f87b2796f604787801ca940cd1283eab7827
SHA512 a9b4f75f6173ff2dfcf5441ad6831d16179dab4e6cedb4d786a5d5bea7bbfad234d707903e4783e92fcd69d73f0b8a336d6439515516304c1b93acb8b55fc39e

memory/3024-23-0x000000001CFE0000-0x000000001CFF6000-memory.dmp

memory/3024-25-0x000000001BC40000-0x000000001BC52000-memory.dmp

memory/3024-26-0x000000001D010000-0x000000001D028000-memory.dmp

memory/3024-27-0x000000001BED0000-0x000000001BEE0000-memory.dmp

memory/3024-28-0x00000000017D0000-0x00000000017D8000-memory.dmp

memory/3024-31-0x00007FFC6E965000-0x00007FFC6E966000-memory.dmp

memory/3024-32-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-33-0x000000001DE30000-0x000000001DE92000-memory.dmp

memory/3024-34-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-35-0x000000001EB30000-0x000000001F0EA000-memory.dmp

memory/3024-36-0x000000001F0F0000-0x000000001F1E0000-memory.dmp

memory/3024-37-0x000000001DFC0000-0x000000001DFDE000-memory.dmp

memory/3024-38-0x000000001E100000-0x000000001E149000-memory.dmp

memory/3024-39-0x000000001F2A0000-0x000000001F310000-memory.dmp

memory/3024-40-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-41-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-42-0x000000001F5C0000-0x000000001F6FC000-memory.dmp

memory/3024-43-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-44-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-45-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

memory/3024-47-0x000000001DA70000-0x000000001DAB4000-memory.dmp

memory/3024-52-0x000000001DB10000-0x000000001DB5A000-memory.dmp

memory/3024-57-0x000000001F410000-0x000000001F46A000-memory.dmp

memory/3024-62-0x000000001DFE0000-0x000000001E006000-memory.dmp

memory/3024-67-0x000000001FC60000-0x000000001FDB4000-memory.dmp

memory/3024-71-0x0000000020000000-0x0000000020136000-memory.dmp

memory/3024-72-0x00007FFC6E6B0000-0x00007FFC6F051000-memory.dmp

C:\Users\Admin\AppData\Roaming\Orcus\lib_3ceb2ea3bf8f49ab8809c1a37d3b9ee2\x64\turbojpeg.dll

MD5 b36cc7f7c7148a783fbed3493bc27954
SHA1 44b39651949a00cf2a5cbba74c3210b980ae81b4
SHA256 c1ce9a872d33fb8757c59b5cd1f26c93b9eeec3e3cf57162c29a0783e6222a38
SHA512 c987c689ecc2cc57350c74ee22b66cb543535bc17b790016ec6407c3d02c539a727f5c38e1451a201e8e7ccfcb4d4639780b6e68cd38b7e67b1b28034ad738a2

memory/1684-76-0x00007FFC4C9B0000-0x00007FFC4C9C0000-memory.dmp

memory/1684-78-0x00007FFC4C9B0000-0x00007FFC4C9C0000-memory.dmp

memory/1684-77-0x00007FFC4C9B0000-0x00007FFC4C9C0000-memory.dmp

memory/1684-79-0x00007FFC4C9B0000-0x00007FFC4C9C0000-memory.dmp

memory/1684-80-0x00007FFC4C9B0000-0x00007FFC4C9C0000-memory.dmp

memory/1684-81-0x00007FFC4A400000-0x00007FFC4A410000-memory.dmp

memory/1684-82-0x00007FFC4A400000-0x00007FFC4A410000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 ce5e7f875f4a907f8aa5387676f04919
SHA1 9f37029d970ad39409af0c6d7e7f187823b47a8e
SHA256 506fecd7529aef4f8041f3fe98a2180fac5b2616eaeb21684a0fc04d414c0b49
SHA512 c818dcd1fe061708fccee16943de3ad3c52804b5b23d1eaf236136e9494f3fd3ede43265807a0227cc9d7e9368cb6d7e34035b41a40525944d95c3fcb33b7677

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 6ba365882a8518d42168e98754ae6291
SHA1 ad9405ef49358ee8dde4f6f1365f85036ad1eba8
SHA256 617633a0b851002e0ff6fc28e26dc5111f8a2274d81b02180e5f8ef22841a032
SHA512 781dfc47f35d9223d47a71718d79919568492d8bc457ed97050c76fb7ebb6a224ad482014a9e1d8be113ba97cddfff351373ae83003599000e228e0e10dc8e67

C:\Users\Admin\AppData\Local\Temp\TCD52D9.tmp\iso690.xsl

MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d