Overview

overview

8

Static

static

3

2026-06-29...er.exe

windows10-2004-x64

8

2026-06-29...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/06/2026, 10:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-29_382681a2c89fbbf231f04a4a96b2619b_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe
  • Size 22.7MB
  • Sample260630-m2fmladt4v
  • SHA256 6bdd7fa461587bcabc1ace80697e23c538882daff9130e1f97eeb362fa86a8b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryransomwarespywarestealer

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-29_382681a2c89fbbf231f04a4a96b2619b_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-29_382681a2c89fbbf231f04a4a96b2619b_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3600
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /x {D9FB7F91-9687-4B09-894D-072903CADEA4} /passive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5020
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4980
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1332
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8DA58C11DEC75FBFA4C7AB8B87A16BEE C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5640
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{499108AC-2C3C-4FFA-9433-5ACD765FA8A2}
        3⤵
        • Executes dropped EXE
        PID:2440
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25D4F882-CFC9-4543-8321-45EC536D51FB}
        3⤵
        • Executes dropped EXE
        PID:2152
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{68EEB74D-317A-49C9-ABAC-0BE9FC883F04}
        3⤵
        • Executes dropped EXE
        PID:5724
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E9EBB31E-A76C-4623-85F0-B2131D6314A7}
        3⤵
        • Executes dropped EXE
        PID:4952
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F45FEF6-3EE4-4063-8696-D34327D9755E}
        3⤵
        • Executes dropped EXE
        PID:2156
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9B539EB2-3C9D-47F5-9F43-D6577D17AE91}
        3⤵
        • Executes dropped EXE
        PID:1796
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{06DDD95A-FFC8-4E2A-ADB3-82FDBE6469B3}
        3⤵
        • Executes dropped EXE
        PID:2276
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB2160D1-C61D-4C07-94FD-85C97AD97690}
        3⤵
        • Executes dropped EXE
        PID:5620
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3DDB1BA7-E8AB-47C9-8F25-C9E52C6EFB22}
        3⤵
        • Executes dropped EXE
        PID:3532
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9406D852-40FF-47CE-A45C-0F37F36AF2ED}
        3⤵
        • Executes dropped EXE
        PID:5300
      • C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{03AF0A3A-50F0-4A69-839F-C00864CF5F0F}
        3⤵
        • Executes dropped EXE
        PID:4564
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5180
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E3DF51512993FBE5B90566E2A623B660 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
          "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe" "/I|0|C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          PID:4828
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:5756
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:1604
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4920
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4628
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:476
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:796
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2128
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:236
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:1860
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2296
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:3056
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
            • Modifies data under HKEY_USERS
            PID:5052
          • C:\Windows\System32\SearchProtocolHost.exe
            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:5200
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:6048
            • C:\Windows\System32\SearchFilterHost.exe
              "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
              2⤵
                PID:2372
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3500
            • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
              "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe"
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3956
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcfilter.inf" "9" "4f0333d67" "0000000000000180" "WinSta0\Default" "0000000000000134" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
              1⤵
              • Manipulates Digital Signatures
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2236
              • C:\Windows\system32\rundll32.exe
                rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{0C80DA54-448A-4636-BDF5-6E3D2955E793} Global\{26D50EF9-9B29-463C-AFD7-5D1253139AFE} C:\Windows\System32\DriverStore\Temp\{b8ab1dc8-7407-9248-a14a-358a3696134d}\qcfilter.inf C:\Windows\System32\DriverStore\Temp\{b8ab1dc8-7407-9248-a14a-358a3696134d}\qcfilter.cat
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:5472
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcser.inf" "9" "4417f2877" "0000000000000180" "WinSta0\Default" "0000000000000134" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:2376
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcmdm.inf" "9" "4f8e1879b" "0000000000000134" "WinSta0\Default" "0000000000000174" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:612
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcwwan.inf" "9" "47c727a63" "0000000000000174" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:4228
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qdbusb.inf" "9" "4d5e0b807" "000000000000016C" "WinSta0\Default" "0000000000000198" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:1000
            • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
              "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe"
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4484

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  e599aef.rbs
                  • Path C:\Config.Msi\e599aef.rbs
                  • Size 37KB
                  • SHA256 a773989cd5d276b4940148431adc41ba119d01e77500c3db0229c70e63791b76
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcusbfilter.sys
                  • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\filter\amd64\qcusbfilter.sys
                  • Size 39KB
                  • SHA256 65b7baabfcb0788147b1a5bb03083008f6040f6c321b6a5e2892680c5eec9abd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcusbwwan.sys
                  • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\ndis\6.2\amd64\qcusbwwan.sys
                  • Size 504KB
                  • SHA256 2d759dfd3a6623edd3b2f1634e6192815c25952094ae72cfbbd9ea46d25f7226
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcfilter.cat
                  • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcfilter.cat
                  • Size 94KB
                  • SHA256 2443015b8822a3793c141571135ef1cb79f324700d33266103e3ba599e1b6c21
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcser.cat
                  • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcser.cat
                  • Size 95KB
                  • SHA256 550507c87bdd89d0619328529fefee2933736c85d239367c5e429e0d6febd07c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcwwan.cat
                  • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcwwan.cat
                  • Size 94KB
                  • SHA256 be76010e324e2fcd9990a82265ff8757375f45fc692202ebf5d974b85fcbc777
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qdbusb.sys
                  • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qdss\amd64\qdbusb.sys
                  • Size 44KB
                  • SHA256 ed89b3315d5ff28ccde22b90680d44c7ad8de630601baa2921c96c25d85aae3f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  wdfcoinstaller01009.dll
                  • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qdss\amd64\wdfcoinstaller01009.dll
                  • Size 1.6MB
                  • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcusbser.sys
                  • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\serial\amd64\qcusbser.sys
                  • Size 239KB
                  • SHA256 6fff206a1def97219541568d76d2077ac5db1daef2c6d995f6ac4a83e57ed898
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  • Size 2.7MB
                  • SHA256 59c47db51d764139d687e2257da6c137688b18d8165e0adee5da1cc7f55d5505
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  maintenanceservice.exe
                  • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  • Size 1.5MB
                  • SHA256 905411c455fd24e232b5058d1d2002fab7c3e03aca762fb9e9b48d2fa62e06b5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  difxapi.dll
                  • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DifxApi\amd64\difxapi.dll
                  • Size 507KB
                  • SHA256 bf0798d3a4540b15f45c5b329798a2ac532ff693764948b9b4757265e145216e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DriverInstaller64.exe
                  • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
                  • Size 2.2MB
                  • SHA256 f0cbd9fb9abc814e470a4126d3f7b7bf2fc769c20593b402ad2cb979e4817625
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcmtusvc.exe
                  • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
                  • Size 81KB
                  • SHA256 b6d6cbf256f08fe397d23c989d41ff6f4bd60b11751f7e7585cfe5dc534b5e26
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcfilter.inf
                  • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcfilter.inf
                  • Size 36KB
                  • SHA256 5fa46ab5487d00840642d82eb321aab0c716b19dc9cd21aaa4af74a7b47a5e2e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcmdm.inf
                  • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcmdm.inf
                  • Size 44KB
                  • SHA256 db8c72dffd89b859c8d3b511d3c0452d031079c21648d94a8cdfb9c403e492dd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcser.inf
                  • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcser.inf
                  • Size 100KB
                  • SHA256 717d8c9eb75808d711ec31ad97f5cf4699798c95d4336f57cc54ff09aab9ff6e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcwwan.inf
                  • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcwwan.inf
                  • Size 72KB
                  • SHA256 635ec113fb8682ccb237afae4de441882a3edd12526fd7d0f4e0450c54cf8bc6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qdbusb.inf
                  • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qdbusb.inf
                  • Size 8KB
                  • SHA256 248c3c0a0a6b2f2a7f7438120906d29c8adbb9ee447dd47d7eb16a7c260f531d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OSE.EXE
                  • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                  • Size 1.5MB
                  • SHA256 ee6045de81355de65bf0c8c0edcea0c2f079ab01611f277e95d28d648e9d03b8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  • Size 2.8MB
                  • SHA256 b87030882878f40e1afa4060a3c810c33404885bccfeb5ae3c5579281ecc597a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                  • Size 1.1MB
                  • SHA256 f573588560676c51f2c1d1dd482213dcbb6680c006dd23653b0c5b3de5da980c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Windows.db-wal
                  • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                  • Size 1.2MB
                  • SHA256 e982d9bd0b8c3479b5e269925ff5b4259bb8c9c3785cd9af33787821b5da630d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSIF940.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\MSIF940.tmp
                  • Size 1.3MB
                  • SHA256 dc5094ceb682772d95b427230bfb1af29df90ef67fe8afb08c43a0f2af3f880a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  QualcommWindowsDriverInstaller.msi
                  • Path C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi
                  • Size 20.7MB
                  • SHA256 a7d18848d352986989170eaae01af8439b91b732544662c80c17bad8605353e5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ISBEW64.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISBEW64.exe
                  • Size 146KB
                  • SHA256 9acc6cb5d01a4e4dbc92c8774c6999fab5f0e49f097e83098ba740842f5a2894
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ISRT.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\ISRT.dll
                  • Size 260KB
                  • SHA256 e91a865c3d60d9d0bce5d5a0a2f551c5e032d5bc13bc40f85091ce46d38064e0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _isres_0x0409.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\{5BF4415A-2694-4EBF-A311-D11914C5CB07}\_isres_0x0409.dll
                  • Size 540KB
                  • SHA256 6366e18a8cbf609c9573f341004e5c2725c23a12973affa90ee7bcc7934ae1b2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSIA85D.tmp
                  • Path C:\Windows\Installer\MSIA85D.tmp
                  • Size 1.6MB
                  • SHA256 2f975e52b9e6a99dd3515f7b9bc30e89d39cb44e9fb1a8f3e43ab330df42f0a4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  perfhost.exe
                  • Path C:\Windows\SysWOW64\perfhost.exe
                  • Size 1.2MB
                  • SHA256 8fa9c44b484aba7751821fe4def22eca0c9027e6fd825e2658baf6958448d7cb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AgentService.exe
                  • Path C:\Windows\System32\AgentService.exe
                  • Size 1.4MB
                  • SHA256 5b3381efd84127697d2666a280996dee94fd045de4a94e2bed34fd7b9c941ca0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\CatRoot2\dberr.txt
                  • Size 76KB
                  • SHA256 c3c1c41651659ad674f68b3cde51e77c702ca50debd6d4155533862c2c4a65d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\CatRoot2\dberr.txt
                  • Size 76KB
                  • SHA256 c72f8309dd612b0874333ddc063303ba55e9c5d0ea8f9be9c17581115ce42532
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\CatRoot2\dberr.txt
                  • Size 76KB
                  • SHA256 04f8bb136fc474c0cb0305bc59af491b4b2eef2b1f3a9adaba872720e22e8c33
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\CatRoot2\dberr.txt
                  • Size 76KB
                  • SHA256 dfefdd3b3286e3c4a9cf3133bc877fa7f7e58603ea5d0663f31604e7aa2e9897
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\CatRoot2\dberr.txt
                  • Size 76KB
                  • SHA256 d8a684bf99504d367be4088168f1ea54f5e790f02f5134bfe36b5a7271ff5677
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\CatRoot2\dberr.txt
                  • Size 77KB
                  • SHA256 a1a0907e710355613db42ce02a46c176f89084367ca1eaea1e2da99c86d45673
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  qcmdm.inf_amd64_dd21d0caf44e7fa8.ini
                  • Path C:\Windows\System32\DriverStore\FileRepository\qcmdm.inf_amd64_dd21d0caf44e7fa8.ini
                  • Size 426B
                  • SHA256 41f7d90d991d084fdfdb4de25c4a282d43881f89f52b15cbb3594221d8b595ec
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  qcser.inf_amd64_7d91b3baab562649.ini
                  • Path C:\Windows\System32\DriverStore\FileRepository\qcser.inf_amd64_7d91b3baab562649.ini
                  • Size 427B
                  • SHA256 8a45fab6e3ec68a8f74086b9e83c8c405a6cd597ca1a9f93e200955ffbd26106
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  qcwwan.inf_amd64_936d995a371b46f4.ini
                  • Path C:\Windows\System32\DriverStore\FileRepository\qcwwan.inf_amd64_936d995a371b46f4.ini
                  • Size 432B
                  • SHA256 f006df486469240363c21c165d8c5bd7ae74770a34111a73c2fd128a4e3ec70d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ssh-agent.exe
                  • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                  • Size 1.8MB
                  • SHA256 a3984e17305177dcb17f7062e9d6ce2062e562cb8b10d5949d0fdd5febb29992
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PerceptionSimulationService.exe
                  • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                  • Size 1.5MB
                  • SHA256 2589a9ea0a793f3a3e94394de4097324246a03b2b59a4ff8d49f2f4b34dc2d2d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ReFsDedupSvc.exe
                  • Path C:\Windows\System32\ReFsDedupSvc.exe
                  • Size 2.6MB
                  • SHA256 83848d1955f3e2592a8809ba6eae0105ce0b7c602a7aa51eb8f7c798b8d29626
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchIndexer.exe
                  • Path C:\Windows\System32\SearchIndexer.exe
                  • Size 1.4MB
                  • SHA256 f88e604e26bd261faaa6c525d95c92f676cfd8a660493c6deddcc0568c1a563e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SensorDataService.exe
                  • Path C:\Windows\System32\SensorDataService.exe
                  • Size 1.7MB
                  • SHA256 dfe945637bd11e475ba288ea7231d27302638e1b0e6e1d128cdaad5f13acd073
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSSVC.exe
                  • Path C:\Windows\System32\VSSVC.exe
                  • Size 1.4MB
                  • SHA256 ca3f42b78aa915f7164964871f514b42b7a4dd01fe2bf92d6458e5549a5de4e6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\catroot2\dberr.txt
                  • Size 76KB
                  • SHA256 cc8ac493e287cc43faad01c2f3b27af256489a158e3d7480a1ee12800853089d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  metadata-2
                  • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                  • Size 26.1MB
                  • SHA256 db9ce0bcdc712806d8a27b243f1c2b86766cadfb0fdbeb33aff72c602996d540
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  {1bc9a3ca-f563-4628-b218-7f6511208baf}_OnDiskSnapshotProp
                  • Path \??\Volume{0c051f61-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1bc9a3ca-f563-4628-b218-7f6511208baf}_OnDiskSnapshotProp
                  • Size 6KB
                  • SHA256 8335b3d4018e72ae0a51709f2329738be17de4562a00caeed7ee4d0f1a049c82
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/236-125-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/236-126-0x0000000000820000-0x0000000000880000-memory.dmp
                  Download

                  memory/236-134-0x0000000000820000-0x0000000000880000-memory.dmp
                  Download

                  memory/236-136-0x0000000140000000-0x0000000140168000-memory.dmp
                  Download

                  memory/236-132-0x0000000000820000-0x0000000000880000-memory.dmp
                  Download

                  memory/476-82-0x0000000000980000-0x00000000009E6000-memory.dmp
                  Download

                  memory/476-318-0x0000000000400000-0x0000000000542000-memory.dmp
                  Download

                  memory/476-76-0x0000000000400000-0x0000000000542000-memory.dmp
                  Download

                  memory/476-77-0x0000000000980000-0x00000000009E6000-memory.dmp
                  Download

                  memory/796-100-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/796-345-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/796-99-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/796-106-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/796-364-0x0000000140000000-0x00000001401BA000-memory.dmp
                  Download

                  memory/796-362-0x0000000000780000-0x00000000007E0000-memory.dmp
                  Download

                  memory/940-361-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/940-142-0x0000000000620000-0x0000000000680000-memory.dmp
                  Download

                  memory/940-141-0x0000000140000000-0x0000000140172000-memory.dmp
                  Download

                  memory/940-148-0x0000000000620000-0x0000000000680000-memory.dmp
                  Download

                  memory/1332-20-0x00000000008A0000-0x0000000000900000-memory.dmp
                  Download

                  memory/1332-19-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/1332-21-0x00000000008A0000-0x0000000000900000-memory.dmp
                  Download

                  memory/1332-111-0x0000000140000000-0x00000001402E9000-memory.dmp
                  Download

                  memory/1332-13-0x00000000008A0000-0x0000000000900000-memory.dmp
                  Download

                  memory/1604-51-0x0000000140000000-0x0000000140180000-memory.dmp
                  Download

                  memory/1604-37-0x0000000140000000-0x0000000140180000-memory.dmp
                  Download

                  memory/1604-45-0x0000000001B60000-0x0000000001BC0000-memory.dmp
                  Download

                  memory/1604-49-0x0000000001B60000-0x0000000001BC0000-memory.dmp
                  Download

                  memory/1604-38-0x0000000001B60000-0x0000000001BC0000-memory.dmp
                  Download

                  memory/2128-112-0x0000000140000000-0x00000001401E9000-memory.dmp
                  Download

                  memory/2128-120-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                  Download

                  memory/2128-114-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                  Download

                  memory/2128-355-0x0000000140000000-0x00000001401E9000-memory.dmp
                  Download

                  memory/2672-376-0x00000000007A0000-0x0000000000800000-memory.dmp
                  Download

                  memory/2672-378-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/2672-339-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/2672-92-0x00000000007A0000-0x0000000000800000-memory.dmp
                  Download

                  memory/2672-86-0x00000000007A0000-0x0000000000800000-memory.dmp
                  Download

                  memory/2672-95-0x0000000140000000-0x00000001402C9000-memory.dmp
                  Download

                  memory/3600-9-0x0000000000400000-0x0000000001AB9000-memory.dmp
                  Download

                  memory/3600-0-0x0000000003950000-0x00000000039B6000-memory.dmp
                  Download

                  memory/3600-94-0x0000000000400000-0x0000000001AB9000-memory.dmp
                  Download

                  memory/3600-626-0x0000000000400000-0x0000000001AB9000-memory.dmp
                  Download

                  memory/3600-5-0x0000000003950000-0x00000000039B6000-memory.dmp
                  Download

                  memory/4484-629-0x0000000000400000-0x0000000000811000-memory.dmp
                  Download

                  memory/4484-624-0x0000000000AC0000-0x0000000000B26000-memory.dmp
                  Download

                  memory/4484-619-0x0000000000AC0000-0x0000000000B26000-memory.dmp
                  Download

                  memory/4484-618-0x0000000000400000-0x0000000000811000-memory.dmp
                  Download

                  memory/4628-293-0x0000000140000000-0x0000000140176000-memory.dmp
                  Download

                  memory/4628-64-0x0000000140000000-0x0000000140176000-memory.dmp
                  Download

                  memory/4628-66-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                  Download

                  memory/4628-72-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                  Download

                  memory/4920-60-0x00000000008C0000-0x0000000000920000-memory.dmp
                  Download

                  memory/4920-53-0x0000000140000000-0x000000014017A000-memory.dmp
                  Download

                  memory/4920-54-0x00000000008C0000-0x0000000000920000-memory.dmp
                  Download

                  memory/4920-269-0x0000000140000000-0x000000014017A000-memory.dmp
                  Download

                  memory/5640-299-0x0000000003440000-0x00000000034C9000-memory.dmp
                  Download

                  memory/5640-271-0x0000000010000000-0x00000000101B5000-memory.dmp
                  Download

                  memory/5640-294-0x00000000032B0000-0x0000000003357000-memory.dmp
                  Download

                  memory/5756-33-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/5756-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download

                  memory/5756-27-0x00000000006E0000-0x0000000000740000-memory.dmp
                  Download

                  memory/5756-171-0x0000000140000000-0x00000001402D4000-memory.dmp
                  Download