Overview

overview

10

Static

static

3

2026-08-19...yn.exe

windows10-2004-x64

10

2026-08-19...yn.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    62s
  • max time network
    83s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 05:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe
  • Size 13.2MB
  • Sample260819-gef2ysdc49
  • SHA256 0ac7de7e102d2a97f879f54a06b00ea478124728e19a1d7507dea2748d125eff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceransomware

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Manipulates Digital Signatures 1 TTPs 2 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 33 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1352
    • \??\c:\users\admin\appdata\local\temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c bcdedit.exe > "C:\Users\Admin\AppData\Local\Temp\usb7DC1.tmp"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe
          4⤵
            PID:2744
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set testsigning on
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:4828
        • C:\Windows\SysWOW64\msiexec.exe
          msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi" REBOOTNEEDED=1
          3⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:4748
      • C:\Windows\Resources\Themes\icsys.icn.exe
        C:\Windows\Resources\Themes\icsys.icn.exe
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5944
        • \??\c:\windows\resources\themes\explorer.exe
          c:\windows\resources\themes\explorer.exe
          3⤵
          • Modifies visibility of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4608
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe SE
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1552
            • \??\c:\windows\resources\svchost.exe
              c:\windows\resources\svchost.exe
              5⤵
              • Modifies visibility of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5240
              • \??\c:\windows\resources\spoolsv.exe
                c:\windows\resources\spoolsv.exe PR
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3172
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 83F9522171A6B714B6DAFB77F81C8D3C C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3316
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7B0F498A-1098-4FB2-B47C-C59B353AB2E7}
          3⤵
          • Executes dropped EXE
          PID:2376
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83D6B6A6-87DB-4CF3-ABFB-AB368F930154}
          3⤵
          • Executes dropped EXE
          PID:2984
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00BBE678-091F-439D-ACF1-0B5FD37D927E}
          3⤵
          • Executes dropped EXE
          PID:5332
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{77390CFD-7765-4B44-B0E4-3BE9963F0838}
          3⤵
          • Executes dropped EXE
          PID:2908
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F838AF0-938B-4C4A-94A9-00D3E7A2448B}
          3⤵
          • Executes dropped EXE
          PID:4256
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07C5B7D2-8644-450C-A2FF-193F39FC4A6F}
          3⤵
          • Executes dropped EXE
          PID:1556
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8B56E2D1-9D79-40F8-812E-15E8767CB587}
          3⤵
          • Executes dropped EXE
          PID:4976
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5490C353-F72A-40ED-B56C-5AF8A52FE491}
          3⤵
          • Executes dropped EXE
          PID:5036
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{02D0AC7D-D54D-468D-A984-565DD8CB5A20}
          3⤵
          • Executes dropped EXE
          PID:2808
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{03123195-802C-4FE9-A946-84F35D16937D}
          3⤵
          • Executes dropped EXE
          PID:4140
        • C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A0B7C81B-9978-43DD-A0F6-5D99034B815E}
          3⤵
          • Executes dropped EXE
          PID:2660
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
          PID:3044
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 7CB27A21B01503076EF2F4150BF860E5 E Global\MSI0000
          2⤵
          • Manipulates Digital Signatures
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3188
          • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
            "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe" "/I|0|C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            PID:5696
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4268
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcfilter.inf" "9" "4f0333d67" "0000000000000160" "WinSta0\Default" "00000000000000DC" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
        1⤵
        • Manipulates Digital Signatures
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:5172
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcser.inf" "9" "4417f2877" "00000000000000DC" "WinSta0\Default" "00000000000000E0" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
        1⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4876
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcmdm.inf" "9" "4f8e1879b" "00000000000000E0" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
        1⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:5508
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcwwan.inf" "9" "47c727a63" "0000000000000178" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
        1⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:5528
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3a36055 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:1852
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:1364
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k CameraMonitor
          1⤵
            PID:5376

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Hide Artifacts

                1
                T1564

                Hidden Files and Directories

                1
                T1564.001

                Modify Registry

                2
                T1112

                Subvert Trust Controls

                1
                T1553

                SIP and Trust Provider Hijacking

                1
                T1553.003

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Inhibit System Recovery

                1
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e5a2b68.rbs
                • Path C:\Config.Msi\e5a2b68.rbs
                • Size 29KB
                • SHA256 742c7a6f5469ce18667f4c6773b87dabb10165aa127921796533efd3c5f7bab6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcusbfilter.sys
                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\filter\amd64\qcusbfilter.sys
                • Size 39KB
                • SHA256 4c97c8ace5c0169c423ac9883b55ea25d3a5679203f96d4608816bd595d19888
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcusbwwan.sys
                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\ndis\6.2\amd64\qcusbwwan.sys
                • Size 478KB
                • SHA256 ed15de767cc38cb65817e6925985aa54813df3065af22f175bcf2e80495fefe6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcfilter.cat
                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcfilter.cat
                • Size 78KB
                • SHA256 c59ae022b54775856ac59dbcf82cfd6cc1552470203adacbaf8c2af6cae2d8a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcser.cat
                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcser.cat
                • Size 79KB
                • SHA256 b86e2a53844268be164723394aaf2009f2a2d378c569d418a418ade6560347ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcwwan.cat
                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcwwan.cat
                • Size 78KB
                • SHA256 50c2aa490e162d15ea5c772536df7213783459da5562bf5195b617a96d3ecd97
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcusbser.sys
                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\serial\amd64\qcusbser.sys
                • Size 238KB
                • SHA256 ca4392cd34163682260850aa1eeb6f7fce1eed59ce9d491a5e18cdba4c7a6225
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                difxapi.dll
                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DifxApi\amd64\difxapi.dll
                • Size 507KB
                • SHA256 bf0798d3a4540b15f45c5b329798a2ac532ff693764948b9b4757265e145216e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DriverInstaller64.exe
                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
                • Size 2.2MB
                • SHA256 196dd86ab07bc1b70536b1d643ef09db88d3e23df6db808a9e2d2136c0c4a95e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcfilter.inf
                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcfilter.inf
                • Size 33KB
                • SHA256 da81dcf11682b118e30f087cb8982a01453f7dedee7e737dfc1da426347dece4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcmdm.inf
                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcmdm.inf
                • Size 40KB
                • SHA256 ed2d4abc492f8d84dc9ef2dc1a1edd0edfe32b57e453287c882ba1584521159d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcser.inf
                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcser.inf
                • Size 94KB
                • SHA256 86c4fc19d53c800431bffea5155c127be83a890b23890bce604ff592bae663e4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcwwan.inf
                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcwwan.inf
                • Size 63KB
                • SHA256 6d7dd3a360534555dd9e264df0696381345919e861d8d3068b7ef870a9e23c95
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcusbtest.cer
                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\testCertificate\qcusbtest.cer
                • Size 580B
                • SHA256 d7f2c685f0aadf936bf6cc96c8ff5a9bb79973c6a0bc9ddd98f30813f20760f6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe 
                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe 
                • Size 13.0MB
                • SHA256 08e5e7e5f30801b363f08a6106425faa1c505bd048a18c846a5b3e5959a4998e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSI8B3F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\MSI8B3F.tmp
                • Size 1.3MB
                • SHA256 c73541a041134a4e9d7e9e5f68aef83fa3f6caad9e9b44b7cba52cd5441a38de
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                QualcommWindowsDriverInstaller.msi
                • Path C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi
                • Size 11.6MB
                • SHA256 ec29ea59edf79119f5cb06fc7e742cd191652e2afebb223d94a98b38dc7c3c5b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                usb7DC1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\usb7DC1.tmp
                • Size 1KB
                • SHA256 c7345b8b07631b7ed16f4e1a0ac127741600cdb4c2f88a3f9c40971060f20269
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ISBEW64.exe
                • Path C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISBEW64.exe
                • Size 146KB
                • SHA256 9acc6cb5d01a4e4dbc92c8774c6999fab5f0e49f097e83098ba740842f5a2894
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ISRT.dll
                • Path C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\ISRT.dll
                • Size 260KB
                • SHA256 e91a865c3d60d9d0bce5d5a0a2f551c5e032d5bc13bc40f85091ce46d38064e0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _isres_0x0409.dll
                • Path C:\Users\Admin\AppData\Local\Temp\{409D6F23-55F6-4EC7-808E-33E706F19F5E}\_isres_0x0409.dll
                • Size 540KB
                • SHA256 6366e18a8cbf609c9573f341004e5c2725c23a12973affa90ee7bcc7934ae1b2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSI3664.tmp
                • Path C:\Windows\Installer\MSI3664.tmp
                • Size 1.6MB
                • SHA256 64454a4208e513f13b3e8f3f011659537d02f6900d8ddff0303055b85cbceee5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                explorer.exe
                • Path C:\Windows\Resources\Themes\explorer.exe
                • Size 135KB
                • SHA256 d00b755b731ab3c3a4c804d1560a0b10dc7c2b9f8ddf1de99b0fa35fd728de5e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icsys.icn.exe
                • Path C:\Windows\Resources\Themes\icsys.icn.exe
                • Size 135KB
                • SHA256 c3e0a78eb667480abdc3423e27dcf4da4cfa6e2265ec7196ba759f55d169f6df
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                spoolsv.exe
                • Path C:\Windows\Resources\spoolsv.exe
                • Size 135KB
                • SHA256 07e3a3f992bfbec3b92551db71095871d38f040c3bf433f7cc7c7d4aeb9e866d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                svchost.exe
                • Path C:\Windows\Resources\svchost.exe
                • Size 135KB
                • SHA256 23ff0f50205e9298f957452cabe3fed4655f99f693dedb9bb1c992deb694b946
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\CatRoot2\dberr.txt
                • Size 75KB
                • SHA256 9b1b5c55945731a4b3a89257c6b95ebd958c7b36208f97754c2650d39b7a9e69
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\CatRoot2\dberr.txt
                • Size 75KB
                • SHA256 079b130985ba1f4d1c1b2b02f1884e48a55b2dbb6c55d5b00c0feeeba753684e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\CatRoot2\dberr.txt
                • Size 76KB
                • SHA256 dbf02a60d5503e32f6008632118cd5aceab6524fccfeb5b75250fdb5f8c93c12
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\CatRoot2\dberr.txt
                • Size 76KB
                • SHA256 ddb9fcfd197704f734e2f1c1ad005b73da10fae7bb5775cf03a3c56e99c4516f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\CatRoot2\dberr.txt
                • Size 76KB
                • SHA256 9f3e45e535c80a0eca6e0167658538ad0463f6f2400e01992e0d53093cadcbdb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\CatRoot2\dberr.txt
                • Size 76KB
                • SHA256 62e8cf080c445cbbdce3c985d5828ece207621612826adbff340af66c63da7dd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qcfilter.inf_amd64_afb4df27bf37e5d2.ini
                • Path C:\Windows\System32\DriverStore\FileRepository\qcfilter.inf_amd64_afb4df27bf37e5d2.ini
                • Size 437B
                • SHA256 059d0963f620b3993966451d766296d9dedf05e4910352de93fc88c3ae16f3d6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                qcmdm.inf_amd64_86d0444f2a27bb9f.ini
                • Path C:\Windows\System32\DriverStore\FileRepository\qcmdm.inf_amd64_86d0444f2a27bb9f.ini
                • Size 426B
                • SHA256 3514c3d645b03d835e1467a78c1eff00e9619f705d0e58ab3ad2bfd7919d66a8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                qcser.inf_amd64_ff127a0fe370f822.ini
                • Path C:\Windows\System32\DriverStore\FileRepository\qcser.inf_amd64_ff127a0fe370f822.ini
                • Size 426B
                • SHA256 d69fda1f61969af1479d243f2cae3e8b22feb3e43331fff3814cc4a4732c7494
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                qcwwan.inf_amd64_808b75773fb87a2b.ini
                • Path C:\Windows\System32\DriverStore\FileRepository\qcwwan.inf_amd64_808b75773fb87a2b.ini
                • Size 432B
                • SHA256 4f5e3b982367217849c4fd1c6ead9a89f48015d2362460a1d6bd91fad93a02fa
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\catroot2\dberr.txt
                • Size 76KB
                • SHA256 4c5355151c8108c90531c1ace7e5e0a61fdf329c60e2bcc326d0ec4af0c9bcbc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                metadata-2
                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                • Size 26.1MB
                • SHA256 0dfe4f05dd88340c12a262cfd723ca4088461f4ff901f03c70b738f67161eee4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                {1a524d6b-25f2-45b1-9258-c5a207cd82e5}_OnDiskSnapshotProp
                • Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1a524d6b-25f2-45b1-9258-c5a207cd82e5}_OnDiskSnapshotProp
                • Size 6KB
                • SHA256 a8de60cc3ecba84d3ebd24c3abd4c6c47273f64eb12ff33f06a77d7709de959a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1352-105-0x0000000000400000-0x000000000041F000-memory.dmp
                Download

                memory/1352-0-0x0000000000400000-0x000000000041F000-memory.dmp
                Download

                memory/1552-103-0x0000000000400000-0x000000000041F000-memory.dmp
                Download

                memory/3172-98-0x0000000000400000-0x000000000041F000-memory.dmp
                Download

                memory/3172-102-0x0000000000400000-0x000000000041F000-memory.dmp
                Download

                memory/3316-42-0x0000000003970000-0x0000000003A17000-memory.dmp
                Download

                memory/3316-41-0x0000000003970000-0x0000000003A17000-memory.dmp
                Download

                memory/3316-47-0x0000000003AF0000-0x0000000003B79000-memory.dmp
                Download

                memory/3316-20-0x0000000010000000-0x00000000101B5000-memory.dmp
                Download

                memory/4608-270-0x0000000000400000-0x000000000041F000-memory.dmp
                Download

                memory/5240-269-0x0000000000400000-0x000000000041F000-memory.dmp
                Download

                memory/5944-104-0x0000000000400000-0x000000000041F000-memory.dmp
                Download