Identifier / Programs / Windows
psr.exe
Steps Recorder file version info (xCyclopedia)
LOLBAS Reconnaissance 1 Sigma rule name it 1 ATT&CK technique 1 documented command 13 known copies with hashes
How psr.exe is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for psr.exe.
1 documented command
Reconnaissance T1113 Screen Capture User privileges
Record a user screen without creating a GUI. You should use "psr.exe /stop" to stop recording and create output file.
psr.exe /start /output {PATH_ABSOLUTE:.zip} /sc 1 /gui 0Trips 1 Sigma rule: mediumScreen Capture Activity Via Psr.EXE by Beyu Denis, oscd.community
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for psr.exe, by Leon Rodenko, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for psr.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real psr.exe?
C:\Windows\system32\C:\Windows\SysWOW64\13 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\psr.exe · signed by Microsoft Windows
293f0a48d00e5909335257775bd8091f09db3a0fe6a9a1b3f2fdbca3a2defe5e10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\psr.exe · signed by Microsoft Windows
51a76e0e6f76a65cbb09084b03b4bd958c81c877c6833ecaa118a451cdc2dbc910.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\psr.exe · signed by Microsoft Windows
4092750b7e9792b6d6cc9d3599b2ebe40bc5d797e51a05985c3cde4ce4095dc410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\psr.exe · signed by Microsoft Windows
4f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\psr.exe · signed by Microsoft Windows
88160871721148021a86d945bcb04fcd483776ff3f1480de33ea8fd56bf4ea8710.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\psr.exe · signed by Microsoft Windows
44a3e9f977ca6c8286e70577d163511ca222f8d99a7b0f0fd0890c3a2a9bf8bd10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\psr.exe · signed by Microsoft Windows
a12ebf100ef959ba9391683ca8d24c0bf4c16cc65d96249f09998adeedc79b9410.0.17763.1282 (WinBuild.160101.0800) · C:\Windows\SysWOW64\psr.exe · signed by Microsoft Windows
7d944ce0dfe4fab3d6d56d7d30f2af8615c6e4cf4311b589022c3bbafb3b741110.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\psr.exe · signed by Microsoft Windows
43bff52aec02a3851737cb2dd5799a5196bd0c3edf30fb482f9f0aa2326910da10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\psr.exe · signed by Microsoft Windows
31304bc037a0d07078d13e83b927fbcb32668c74a9f0a280aebfbf068a0b0dcd10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\psr.exe · signed by Microsoft Windows
e8b207e3b896e8864bf098203ff4b1677a88a4e6bb638103efe44780ec4df6b46.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\psr.exe · not signed
0ff1a185fc4201cc2154b6e5edbf1c4ff1a487d130feed4e841bf688ef10bc3b6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\psr.exe · not signed
1453645897c643fa8870081fe1c592bfecd8de9755665eed239729fd801ab5acFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.