orcus | 4d16ea2627fd545be1118d4b2b834f17915324d20e356fb2f311f729f7961b76

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe
Size 1.8MB
Sample261012-eb4bzafa83
SHA256 4d16ea2627fd545be1118d4b2b834f17915324d20e356fb2f311f729f7961b76
MD5 e0ef66a013e6fea26ba01c3a2509db57
SHA1 50b574b62eb6dd0ab494c5a1623cf2339e44c235
SHA512 24b2faa7b8c997f5303828033cba5182228398c146d62304c23f7a55d1839b21f6d55d9877124ccfa7d192700399eaa71df5e31095e79b1dba311f8730505ba1
SSDEEP 49152:7LeVE/BpTeYCpjYySMiQ/rrcI0AilFEvxHPcN6Sl9Te:7CK71CNLSBn
TLSH
T17C95D0013BF96932C1BF7275A77719892378E4172202EA4A395C025C1FDB714AE7A3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xiv defense_evasion discovery orcus persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

Extracted

Family

orcus

Botnet

95.165.149.124:10134

Mutex

45dac0fb4f334bc9a912d6fdc6379678

Attributes

autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\Chrome\Updater.exe
reconnect_delay
10000
registry_keyname
Updater
taskscheduler_taskname
Discord
watchdog_path
AppData\Winlogon.exe

Signatures

Family: Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5b8-186.dat	family_orcus

Detects executables containing common artifacts observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/4224-1-0x0000000000720000-0x00000000008FA000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x000d00000001c5b8-186.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/memory/3000-193-0x0000000000360000-0x000000000044C000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables manipulated with Fody 3 IoCs

resource	yara_rule
behavioral2/memory/4224-1-0x0000000000720000-0x00000000008FA000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral2/files/0x000d00000001c5b8-186.dat	INDICATOR_EXE_Packed_Fody
behavioral2/memory/3000-193-0x0000000000360000-0x000000000044C000-memory.dmp	INDICATOR_EXE_Packed_Fody

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5b8-186.dat	orcus

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
behavioral2/memory/3000-201-0x0000000005460000-0x0000000005468000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Winlogon.exe	Updater.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Winlogon.exe	Winlogon.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Winlogon.exe	Winlogon.exe

Executes dropped EXE 13 IoCs

pid	Process
4976	qlauncher-rcedit.exe
3000	qLoader.exe
1532	WindowsInput.exe
1636	WindowsInput.exe
3344	Updater.exe
6080	Updater.exe
5212	Winlogon.exe
2228	Winlogon.exe
3944	qLauncher.exe
3408	qLauncher.exe
4908	qLauncher.exe
4736	qLauncher.exe
2308	qLauncher.exe

Loads dropped DLL 5 IoCs

pid	Process
4908	qLauncher.exe
2308	qLauncher.exe
4908	qLauncher.exe
4908	qLauncher.exe
4908	qLauncher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Updater = "\"C:\\Program Files (x86)\\Chrome\\Updater.exe\""	Updater.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.exe	qLoader.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	qLoader.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Chrome\Updater.exe	qLoader.exe
File created	C:\Program Files (x86)\Chrome\Updater.exe.config	qLoader.exe
File opened for modification	C:\Program Files (x86)\Chrome\Updater.exe	qLoader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	qLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	qLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	qLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	qLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	qLoader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	qLoader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInput.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInput.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlauncher-rcedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qLoader.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	qLauncher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4224	2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe
2228	Winlogon.exe
2228	Winlogon.exe
2228	Winlogon.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe
3344	Updater.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe
2228	Winlogon.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe
2228	Winlogon.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe
2228	Winlogon.exe
3344	Updater.exe
2228	Winlogon.exe
2228	Winlogon.exe
3344	Updater.exe
3344	Updater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe
Token: SeDebugPrivilege	3344	Updater.exe
Token: SeDebugPrivilege	5212	Winlogon.exe
Token: SeDebugPrivilege	2228	Winlogon.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe
Token: SeShutdownPrivilege	3944	qLauncher.exe
Token: SeCreatePagefilePrivilege	3944	qLauncher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3344	Updater.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3344	Updater.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4976	4224	2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe	89
PID 4224 wrote to memory of 3000	4224	2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe	91
PID 3000 wrote to memory of 1532	3000	qLoader.exe	94
PID 3000 wrote to memory of 3344	3000	qLoader.exe	96
PID 3344 wrote to memory of 5212	3344	Updater.exe	98
PID 5212 wrote to memory of 2228	5212	Winlogon.exe	99
PID 4224 wrote to memory of 3944	4224	2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe	101
PID 3944 wrote to memory of 3408	3944	qLauncher.exe	102
PID 3944 wrote to memory of 4908	3944	qLauncher.exe	103
PID 3944 wrote to memory of 4736	3944	qLauncher.exe	104
PID 3944 wrote to memory of 2308	3944	qLauncher.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadaman.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\qlauncher-rcedit.exe
  "C:\Users\Admin\AppData\Local\Temp\qlauncher-rcedit.exe" "C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe" --set-icon "C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.ico" --set-version-string ProductName qLauncher --set-version-string FileDescription qLauncher --set-version-string CompanyName qlauncher.xyz --set-version-string OriginalFilename qLauncher.exe --set-version-string InternalName qLauncher --set-file-version 1.0.0 --set-product-version 1.0.0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4976
- C:\Users\Admin\AppData\Local\Programs\qLauncher\qLoader.exe
  "C:\Users\Admin\AppData\Local\Programs\qLauncher\qLoader.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe" --install
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1532
- - C:\Program Files (x86)\Chrome\Updater.exe
    "C:\Program Files (x86)\Chrome\Updater.exe"
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Users\Admin\AppData\Roaming\Winlogon.exe
      "C:\Users\Admin\AppData\Roaming\Winlogon.exe" /launchSelfAndExit "C:\Program Files (x86)\Chrome\Updater.exe" 3344
      4⤵
      Executes a file named after a Windows system binary
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5212
    - - C:\Users\Admin\AppData\Roaming\Winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\Winlogon.exe" /watchProcess "C:\Program Files (x86)\Chrome\Updater.exe" 3344
        5⤵
        Executes a file named after a Windows system binary
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
- C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\qLauncher" --field-trial-handle=1844,i,1219411860911410987,17292870741605319725,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,12171720607838743486,15861108501702796214,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1876 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:3408
- - C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\qLauncher" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1844,i,1219411860911410987,17292870741605319725,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,12171720607838743486,15861108501702796214,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1840 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4908
- - C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\qLauncher" --app-path="C:\Users\Admin\AppData\Local\Programs\qLauncher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=620047111 --field-trial-handle=1844,i,1219411860911410987,17292870741605319725,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,12171720607838743486,15861108501702796214,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2528 /prefetch:1
    3⤵
    - Executes dropped EXE
    PID:4736
- - C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\qLauncher" --app-path="C:\Users\Admin\AppData\Local\Programs\qLauncher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=620064831 --field-trial-handle=1844,i,1219411860911410987,17292870741605319725,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,12171720607838743486,15861108501702796214,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2704 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2308

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1636

C:\Program Files (x86)\Chrome\Updater.exe
"C:\Program Files (x86)\Chrome\Updater.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\chrome_100_percent.pak
Size 702KB
SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
MD5 8bd180ba5ae087e7348c8e5d3fc747b9
SHA1 032e54936f0a96b9e008a77666e8739f6ff56341
SHA512 8f52ca1c25bbfacefdeb869ba8b2725a12269f5df40ae50744bcb7f4f68df6cf8ab6a6a63116969d07a9ca80caaadcd6b3542f056cf1317e55e7c1bfe8c2b28b
SSDEEP 12288:QI3HWfJwNjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnzzmg/YJblIt6kjKQCrC:H32Bw7zEEmPLVbTe+gnzzmgwbc6kGQt
TLSH
T159E412E77370AC7DEEAB1677426614B0FC375A280B51060A17DAF8796923B48D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\chrome_200_percent.pak
Size 1.2MB
SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
MD5 62dc1994f062c83fce3944c829165007
SHA1 1ab2de2406114a4c4e32ca3dc4d6f8515cb4d6cd
SHA512 1d4b7acedaa54d376764ea1709750cb102b326fa4a993bad7b8ef4c4961950c52541dd79a8789709bfaa5aebbed0c6fe5a781866512c56da660ea7ed2c55befd
SSDEEP 24576:73WBS9n2zLmmibkFR8+mZiqr8BWhQumesXRvQtgIQwuSXAkpbaUGQ74:73P23mNbkFRJmQ+8khQRn1Q68uSXAk78
TLSH
T1754522D7D770AC3EDD520B77939B20E0FD7600271A61190F0B26BD7929276C8DA96B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\dxcompiler.dll
Size 24.6MB
SHA256 22d415f86ce445f4beb57afbb6856b3b83f19918ad270b6ae6047168ec73956d
MD5 e301f37e2dfca8d2b501d3444c7ef14d
SHA1 ab37e6e1c6e90979f087fc668477ca77d8fd5b48
SHA512 3dcf375486027189d3b2ec571ed452df861e5e9cb8df7d0377ea10e3b7967fcf9be6db4e1d86e67aa154b54f320c10a6ed3e173c862dcfbb4e1ff800a9a0a1da
SSDEEP 393216:90MTWaO7famOUjsa5NzmgVkWhKvSpOhqJUELYbPMn:Yaba5Nz6Whr+qJ0PMn
TLSH
T1AA4729122646D49CC099C879C7678B268A2C30E73FA7B9EFC0F451252B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\ffmpeg.dll
Size 3.0MB
SHA256 d38957b4351486a16141bdd3162643b811564ba6bfa1d12f374c13b70207dc11
MD5 b55e35efbec9cdd8887bd9ab651e83e7
SHA1 849bd96ba5d71271ad9fb276baa6a61f17bd9eae
SHA512 1ef1e6108629ee1ea7c734e4b4a0eb09b5369dfac890e078d012e39c4596b0884e6ec0c120aed2fba872c712d39d1d8720a3d01d461a432c5d3ef86a8266f700
SSDEEP 49152:Yagye0i1JBlvS0ZU3oAQULMsvpTwDowaY9/Gz/YaLuPLuf0E6OOlz2H1:YJ1lS0ZcoAs9HaLuThe
TLSH
T182E5AE03F6D251EDD019C03497AB9213F271780A8F205AEF17A05A253F66FE86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\icudtl.dat
Size 10.4MB
SHA256 da53f0b69843aaa43315f0f210a67e4a874b0be338f3dae08ff57b8afe76ab0d
MD5 d5136270d87d40d2c1c6df098f53002a
SHA1 d167e8c8183258dc8714a84993b823dbd7390add
SHA512 55709f3a14e9402860ff2648bde887e7bb7674278c088e36ce20e6b107735cca68a210a091ca72f816803d27998e188b78aedf18cbfa24ad17cbfd4caec9376b
SSDEEP 98304:g/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjnd0p89s:g/cBhORok2HiXUxO/RJk3IWhlYntjdPs
TLSH
T136B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\locales\en-US.pak
Size 572KB
SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
MD5 3d66180f21df40a9eb941814676972eb
SHA1 b74b6ceba72cd5ca9e662acca19285037995c362
SHA512 4ef14702236e389409bd875dfc0b3f467f8b15c9e97c13dacedfc751642445141de31d6ccc574c8aa4dd788c2e756a16ded3262eb0c577b2b0e82ff526638efc
SSDEEP 6144:pUTO8xSUd/7b7/wg7HfwKOF7Nt3/p9XhMP96hgREfaY+43Um8tjmngcs/wEwj:mqL8f7/weHfwpNbMUhgR2uj1wj
TLSH
T12AC44D1FF784122A05935262BF099572FF32D06CA36112663CBD812C3376B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qLauncher.ico

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\qLauncher.ico
Size 110KB
SHA256 ca9958fe2bbf6bb8116c64017bf41d70491a8e21bf3136d4dd853fae9e5d879d
MD5 c5a98e27e3334ec31047d73a04575391
SHA1 cbfca3265ffb4e02aef519fb3ee30d9dbcf79b55
SHA512 9b0b5a16f70ad5f53d520e8f5d2190e7f02f7e724a9f7f4817f568c9de0079c12847bf4df731fcfb25d4feb9cc355c09f70302291e66878a46218081187a6e13
SSDEEP 3072:+yaGKHHYbVsPL995ecr4ZU+FrfyJGJp7QPsbWUfzemdR8ni:+DGKnisPBjescLDQAW678ni
TLSH
T153B312B3A8303658DCCA5D39B14FD5412DDE0AB907AC7BFC4D099F69D46A8068C2785F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qLoader.exe

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\qLoader.exe
Size 923KB
SHA256 a55b1d75ff0d362af192bb7a915cb4a34c06a6581395287778b6c4c46c40a0ca
MD5 a0d61b2bed5cd2b415800fdb9900c583
SHA1 46ec202c13f2c4683d9e3cf8077f63147496d05e
SHA512 a81be3e9b42ee546ec6ed59ac84002b6a442be75f7bb452a7ec0b65053375098522ec14670758c887c9a517f85a3e19c4e9d8ee1ddd817c84f3f4360bd955df8
SSDEEP 24576:3pX4MROxnF633c6rrcI0AilFEvxHPHooQ:3SMiQ/rrcI0AilFEvxHP
TLSH
T1EC15BF113FACBD17C1BE3679B3731AD907B8E80A6052FB4E086851AD1D9B701BD1636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\resources.pak
Size 11.9MB
SHA256 335d91338d271cc341cbea39179941cf043965f47aa5d1cd8ef0c98401ddcf9f
MD5 2b684447f9618078b99f384190e48791
SHA1 23b3b6883e3d65addcbbebafd1775c37249baa7e
SHA512 0c77b5aab1022346b96cfd59f5ee14163645079a979387a5df92be5125917f9de257786ab78abf9ea5a1ab0636bf2cf3dce70f5cdad21caab9aa073cd2ad1447
SSDEEP 196608:kRR3ZeqsPzZOgYimq8oR/5e7sbajSu5CeVX2uDK/cfOJsj5OkrFAceC/Zh2tX3fT:kLZelLgg9mno8sb435C68gOkrFJeCD2N
TLSH
T1BAC633983364286FDE2123F3822D1237DE69DD0B156590E30EAC3058DEB796C9FDA539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\resources\app.asar
Size 509KB
SHA256 f87c4fbd618077a2e54edbf4f993e49fc2638dfa41ac20cff7376bf8638ecc21
MD5 c5c17eaeec212aa160e6f1fb7c200cb8
SHA1 7ef3da3d136c21da37f29a59396fc070dee1c78a
SHA512 412b3113b0ab9fb4fb572b9126934030fb058306aa15d0256e730c6bd1968b8afe466a2df21192f8aab1319edeb642f708af82db794b497c4458d61ffeab10ce
SSDEEP 12288:VSkVvf+8w6WseV/Cs3+sjX+QWnyaSor5OuJbkXBe1G:/1FeVZzX+dnya7+
TLSH
T1B6B48D461AF72235C563F1759B4BA40AB329C017320ADA547EAC43486FCA53C86FFBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\v8_context_snapshot.bin
Size 724KB
SHA256 883f08309bf436fb442d1903452a69c03747ed77c5f502e88667d9aa1b706556
MD5 8f45a7562576a637b1ed8abc6dc0b1c2
SHA1 28632b9ae52bca7fe2da001c19c0d8aa934b6c42
SHA512 3c12045e577db35d761fe64ad99b2048d2fb652ec350d9db61356d5da47f3bb8ca138e30c59b364f9ed13cfdc437516a5ccbc7ca671daade089fb226dbc51e81
SSDEEP 6144:ut+HwDNl/6KyRYqz2W6tgrYVLrgV2wXrIr2ff/sey5r838EV6vTB52WeVvV6AO1j:kDyKsYqz2W6tPsNXa/2jlPU5
TLSH
T1F0F4B3B6F50B8B31CA951B3D8EEB8E4B3A74F19DEE87C10B3151577C65B96A08E4240C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\qLauncher\vk_swiftshader.dll
Size 5.3MB
SHA256 e66cfe13aafbd7d80226e3ce085de5786479de35f7d6a75eded9ecb4ebf9784b
MD5 62e84aed04270080784065064f245e95
SHA1 9f46fcfa1d642a3ed4777385f7d67145204a3fac
SHA512 64bde620122afeb27c524f24b2b414d4031ef5b5d3f657c8ba68739e58acd8f764b17cb64e215ed7ae2f84eadfe2865756d8f3c45a3486aead21955e20022953
SSDEEP 49152:AsbF8aGwMFhn4X6t+LsctbWSRIWHyQ1TKhwI+AODvOrSfehTwm6+v16TbG4UqGBb:AsbF+YDkg5sBLa
TLSH
T1A5464903F69681D9C06DE6798B5FA623F631F8800B2276DF56A00F192E66FE0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlauncher-rcedit.exe

Path C:\Users\Admin\AppData\Local\Temp\qlauncher-rcedit.exe
Size 149KB
SHA256 e2df7b664db830f159d0dc6b3da8a95442cca175b9577f2d19952646d37ac32f
MD5 13da8fa9aa537ecc0b87202b6af27d54
SHA1 7d588608908154f735a9d71c2a6353167b471965
SHA512 db0e1ae3511c1e5eca1606c765899f5424bd7d6a67513bbf799a7c9a3016e617fab9f181252c669750bd0fcd9203837910989e80a82dee2a55914772e147bceb
SSDEEP 3072:Yblkn7ok449Q1CH0A1/7SrLoN+ktBph8VQ/uU4:Y5kEC9QA/7SrLoN3tdX4
TLSH
T1BCE36B1136D1C032E9A302364DB8AF65597EFE724B7299DBB3880B5E0D347D0AA35B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

err_45dac0fb4f334bc9a912d6fdc6379678.dat

Path C:\Users\Admin\AppData\Roaming\Chrome\err_45dac0fb4f334bc9a912d6fdc6379678.dat
Size 1KB
SHA256 0186257e12b7b340159e58f4a46c241717e0396778cc8b4d15faf9c0df90cb71
MD5 148b9467ce5caabee8fa0e06adcf7e93
SHA1 58a24f364e2e861a27ddb78b92869fd9e2adeeec
SHA512 185c7c5b73d9fc98febd212e2e427e4265508fb9cd9d2505ea8cf7ba8ce19cb1a6349f0a64e6a544d3a4ed0a76d6dbc8d3352d0cd306a9d962d13e7a5f4457ea
TLSH
T1FF31BE2E4B71FDC0072C7180E5292EE321C84A61EBB50B38E6961CBB1C25796DF1B68C
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Winlogon.exe

Path C:\Users\Admin\AppData\Roaming\Winlogon.exe
Size 9KB
SHA256 8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
MD5 913967b216326e36a08010fb70f9dba3
SHA1 7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA512 c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
SSDEEP 96:jmqLxbUsEIoD6sO4IcAh3VnRk3ieU6fsPC8+hKkBLiWTSFThPATlHNUpjbGxdRzj:jmST5dnhTgKXPCPhvBLiW+FFAoSp
TLSH
T1EB12EB4AA3D8C772DDAD0A7E6C6353610B71E3819527DBAE188C615B6D133804AE3B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\qLauncher\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\qLauncher\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\qLauncher\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\qLauncher\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\qLauncher\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

WindowsInput.exe

Path C:\Windows\SysWOW64\WindowsInput.exe
Size 21KB
SHA256 8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
MD5 e6fcf516d8ed8d0d4427f86e08d0d435
SHA1 c7691731583ab7890086635cb7f3e4c22ca5e409
SHA512 c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
SSDEEP 384:v4I7s3DhDXbdCEiWByrv0/5OPovw+BdkDGIMA10qKpWn:gggDhDXxeWwDgOD7
TLSH
T16CA22BA557E8433FDBF80F3CBCB3134002B3A849AD22D76D4B74956D2C26B9A6460B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInput.exe.config

Path C:\Windows\SysWOW64\WindowsInput.exe.config
Size 357B
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
TLSH
T1D3E0BF2D45E8FD2B9D329A537722C4A6EFB091B3A0B5550CB05FA95B073308F429B326
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1532-225-0x0000000002B50000-0x0000000002B8C000-memory.dmp

Download

memory/1532-224-0x0000000001210000-0x0000000001222000-memory.dmp

Download

memory/1532-223-0x0000000000850000-0x000000000085C000-memory.dmp

Download

memory/1636-229-0x000000001ACC0000-0x000000001ADCA000-memory.dmp

Download

memory/3000-234-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/3000-193-0x0000000000360000-0x000000000044C000-memory.dmp

Download

memory/3000-202-0x0000000005BF0000-0x0000000005C56000-memory.dmp

Download

memory/3000-203-0x0000000006280000-0x0000000006898000-memory.dmp

Download

memory/3000-204-0x0000000005C80000-0x0000000005C92000-memory.dmp

Download

memory/3000-205-0x0000000005CE0000-0x0000000005D1C000-memory.dmp

Download

memory/3000-206-0x0000000005D20000-0x0000000005D6C000-memory.dmp

Download

memory/3000-207-0x0000000005EA0000-0x0000000005FAA000-memory.dmp

Download

memory/3000-209-0x0000000006230000-0x0000000006252000-memory.dmp

Download

memory/3000-200-0x0000000005030000-0x0000000005038000-memory.dmp

Download

memory/3000-199-0x0000000005020000-0x0000000005032000-memory.dmp

Download

memory/3000-198-0x0000000005040000-0x00000000050D2000-memory.dmp

Download

memory/3000-197-0x0000000005530000-0x0000000005AEA000-memory.dmp

Download

memory/3000-196-0x0000000004E90000-0x0000000004EEC000-memory.dmp

Download

memory/3000-195-0x0000000002830000-0x000000000283E000-memory.dmp

Download

memory/3000-191-0x0000000074AF2000-0x0000000074AF3000-memory.dmp

Download

memory/3000-201-0x0000000005460000-0x0000000005468000-memory.dmp

Download

memory/3000-194-0x0000000074AE0000-0x000000007529C000-memory.dmp

Download

memory/3344-239-0x0000000006A80000-0x0000000006A98000-memory.dmp

Download

memory/3344-240-0x0000000006C30000-0x0000000006C40000-memory.dmp

Download

memory/3344-242-0x0000000007870000-0x000000000787A000-memory.dmp

Download

memory/3344-238-0x0000000006880000-0x00000000068CE000-memory.dmp

Download

memory/4224-9-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-15-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-1-0x0000000000720000-0x00000000008FA000-memory.dmp

Download

memory/4224-10-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-11-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-12-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-8-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-7-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-0-0x00007FFE297BF000-0x00007FFE297C0000-memory.dmp

Download

memory/4224-14-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-192-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-17-0x000000001CE90000-0x000000001CEA2000-memory.dmp

Download

memory/4224-18-0x000000001B760000-0x000000001B76A000-memory.dmp

Download

memory/4224-6-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-5-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-4-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-3-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-327-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/4224-2-0x00007FFE29630000-0x00007FFE29FD4000-memory.dmp

Download

memory/5212-254-0x0000000000840000-0x0000000000848000-memory.dmp

Download