Overview

overview

9

Static

static

3

2026-09-29...er.exe

windows10-2004-x64

2026-09-29...er.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    43s
  • max time network
    80s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 03:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-09-29_376a174ed897112563592e6999c42799_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe
  • Size 13.6MB
  • Sample260930-dl6peasekd
  • SHA256 5c80b51895e2fe3ea460295bf828e1c44ffd609b7a65f69439e0c1d79638efc0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryevasionexecutionransomwarespywarestealer

Malware Config

Signatures

  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 41 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_376a174ed897112563592e6999c42799_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_376a174ed897112563592e6999c42799_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c bcdedit.exe > "C:\Users\Admin\AppData\Local\Temp\usb907E.tmp"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5972
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe
        3⤵
          PID:5932
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set testsigning on
        2⤵
        • Modifies boot configuration data using bcdedit
        PID:2992
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi" REBOOTNEEDED=1
        2⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:612
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      PID:1884
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4808
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:5772
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4204
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2328
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5020
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      PID:2932
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:3400
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4896
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:696
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2848
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:1348
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2736 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
          • Modifies data under HKEY_USERS
          PID:6016
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
          • Modifies data under HKEY_USERS
          PID:5064
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding D8B62214482B0318ED44B79BCD72669A C
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5852
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B027816C-5D40-4215-B889-6321809C58D9}
            3⤵
            • Executes dropped EXE
            PID:5896
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C4300BA5-FC6E-46E8-A579-C5FC21EE4A52}
            3⤵
            • Executes dropped EXE
            PID:4264
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8FF13217-407E-4686-B793-76A6CF16E893}
            3⤵
            • Executes dropped EXE
            PID:4068
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A124B27F-4467-4AF5-BE36-EA306A4C6392}
            3⤵
            • Executes dropped EXE
            PID:928
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F701145E-E8F6-4983-91F9-D1DBE6B7AB32}
            3⤵
            • Executes dropped EXE
            PID:5316
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F9547EFF-6B15-44BA-A4EA-D462EE375CBA}
            3⤵
            • Executes dropped EXE
            PID:3480
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F65E9358-1F78-4A20-8039-577B9A7655D8}
            3⤵
            • Executes dropped EXE
            PID:5480
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C9D6575A-E9AE-432A-9FE3-3013130E3B07}
            3⤵
            • Executes dropped EXE
            PID:780
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E01B41DA-F4BF-40F9-857A-F3018E84424C}
            3⤵
            • Executes dropped EXE
            PID:2704
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{26C98269-B4C6-4178-A43C-CF46A4059834}
            3⤵
            • Executes dropped EXE
            PID:1776
          • C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3AEA03F9-199C-4E62-B3DD-84521C9452AC}
            3⤵
            • Executes dropped EXE
            PID:5836
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          2⤵
            PID:1856
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding E1876AF1DD3FAFF6CCBF1FC6939EB50A E Global\MSI0000
            2⤵
              PID:4416
              • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
                "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe" "/I|0|C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\
                3⤵
                  PID:5388
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:5384
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcfilter.inf" "9" "4f0333d67" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
              1⤵
                PID:1948
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcser.inf" "9" "4417f2877" "00000000000000DC" "WinSta0\Default" "0000000000000190" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
                1⤵
                  PID:1076
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcmdm.inf" "9" "4f8e1879b" "0000000000000190" "WinSta0\Default" "00000000000000E0" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
                  1⤵
                    PID:6068
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcwwan.inf" "9" "47c727a63" "00000000000000E0" "WinSta0\Default" "000000000000011C" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7"
                    1⤵
                      PID:2736
                    • C:\Windows\system32\LogonUI.exe
                      "LogonUI.exe" /flags:0x4 /state0:0xa39c2855 /state1:0x41c64e6d
                      1⤵
                        PID:5044
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                        1⤵
                          PID:4980
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k CameraMonitor
                          1⤵
                            PID:2648

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                e5a547b.rbs
                                • Path C:\Config.Msi\e5a547b.rbs
                                • Size 29KB
                                • SHA256 04ca09fe448c6abb2d2696df82678ec52833e81a940897cbc4a48b834d100be2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcusbfilter.sys
                                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\filter\amd64\qcusbfilter.sys
                                • Size 39KB
                                • SHA256 4c97c8ace5c0169c423ac9883b55ea25d3a5679203f96d4608816bd595d19888
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcusbwwan.sys
                                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\ndis\6.2\amd64\qcusbwwan.sys
                                • Size 478KB
                                • SHA256 ed15de767cc38cb65817e6925985aa54813df3065af22f175bcf2e80495fefe6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcfilter.cat
                                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcfilter.cat
                                • Size 78KB
                                • SHA256 c59ae022b54775856ac59dbcf82cfd6cc1552470203adacbaf8c2af6cae2d8a2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcser.cat
                                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcser.cat
                                • Size 79KB
                                • SHA256 b86e2a53844268be164723394aaf2009f2a2d378c569d418a418ade6560347ab
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcwwan.cat
                                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\qcwwan.cat
                                • Size 78KB
                                • SHA256 50c2aa490e162d15ea5c772536df7213783459da5562bf5195b617a96d3ecd97
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcusbser.sys
                                • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\Windows7\serial\amd64\qcusbser.sys
                                • Size 238KB
                                • SHA256 ca4392cd34163682260850aa1eeb6f7fce1eed59ce9d491a5e18cdba4c7a6225
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                elevation_service.exe
                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                • Size 2.7MB
                                • SHA256 1190f32b2f5b300a1fb96df81d394865352f553d9a71946d5cfd0e8c3474382f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                maintenanceservice.exe
                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                • Size 1.5MB
                                • SHA256 cbf86e9e5d609f73178acf6ebc9dda9cd2e9b73efb2d5929397123624527266d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                difxapi.dll
                                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DifxApi\amd64\difxapi.dll
                                • Size 507KB
                                • SHA256 bf0798d3a4540b15f45c5b329798a2ac532ff693764948b9b4757265e145216e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                DriverInstaller64.exe
                                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
                                • Size 2.2MB
                                • SHA256 196dd86ab07bc1b70536b1d643ef09db88d3e23df6db808a9e2d2136c0c4a95e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcfilter.inf
                                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcfilter.inf
                                • Size 33KB
                                • SHA256 da81dcf11682b118e30f087cb8982a01453f7dedee7e737dfc1da426347dece4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcmdm.inf
                                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcmdm.inf
                                • Size 40KB
                                • SHA256 ed2d4abc492f8d84dc9ef2dc1a1edd0edfe32b57e453287c882ba1584521159d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcser.inf
                                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcser.inf
                                • Size 94KB
                                • SHA256 86c4fc19d53c800431bffea5155c127be83a890b23890bce604ff592bae663e4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcwwan.inf
                                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows7\qcwwan.inf
                                • Size 63KB
                                • SHA256 6d7dd3a360534555dd9e264df0696381345919e861d8d3068b7ef870a9e23c95
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcusbtest.cer
                                • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\testCertificate\qcusbtest.cer
                                • Size 580B
                                • SHA256 d7f2c685f0aadf936bf6cc96c8ff5a9bb79973c6a0bc9ddd98f30813f20760f6
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                OSE.EXE
                                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                • Size 1.5MB
                                • SHA256 3133f67b2db4b5476b1ef67b841177890ffd319b77229ae87f566a7ee79e2d30
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                elevation_service.exe
                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                • Size 2.8MB
                                • SHA256 9678156a3a8840474fc606475466d72263d0e71d804cbc537ce101fc60d753f8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Windows.db
                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                • Size 1.2MB
                                • SHA256 b5c26143ff9ff36150a27f51f996ca340c2650db3efe5bcf40a492cbe198ae57
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Windows.db-wal
                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                • Size 241KB
                                • SHA256 9722ed2905aa5f3f47255e123b67a5db0050e3c2cc82b896a9ee4269702ef7c0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MSIA35A.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\MSIA35A.tmp
                                • Size 1.3MB
                                • SHA256 c73541a041134a4e9d7e9e5f68aef83fa3f6caad9e9b44b7cba52cd5441a38de
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                QualcommWindowsDriverInstaller.msi
                                • Path C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi
                                • Size 11.6MB
                                • SHA256 ec29ea59edf79119f5cb06fc7e742cd191652e2afebb223d94a98b38dc7c3c5b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                usb907E.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\usb907E.tmp
                                • Size 1KB
                                • SHA256 7f107b60872950fb772d7e86efedf6a89cbe04a687939e30927c38133f068e01
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                ISBEW64.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISBEW64.exe
                                • Size 146KB
                                • SHA256 9acc6cb5d01a4e4dbc92c8774c6999fab5f0e49f097e83098ba740842f5a2894
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ISRT.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\ISRT.dll
                                • Size 260KB
                                • SHA256 e91a865c3d60d9d0bce5d5a0a2f551c5e032d5bc13bc40f85091ce46d38064e0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _isres_0x0409.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\{6C15E882-DDCE-4A19-A946-389F57212326}\_isres_0x0409.dll
                                • Size 540KB
                                • SHA256 6366e18a8cbf609c9573f341004e5c2725c23a12973affa90ee7bcc7934ae1b2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MSI611E.tmp
                                • Path C:\Windows\Installer\MSI611E.tmp
                                • Size 1.6MB
                                • SHA256 64454a4208e513f13b3e8f3f011659537d02f6900d8ddff0303055b85cbceee5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                perfhost.exe
                                • Path C:\Windows\SysWOW64\perfhost.exe
                                • Size 1.2MB
                                • SHA256 c1e524eba03354377f14901f2e491fc4622eb7b345a21396d9689a3ee9077d1e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AgentService.exe
                                • Path C:\Windows\System32\AgentService.exe
                                • Size 1.4MB
                                • SHA256 06e88768632f3543cf38b300c335de155b8c560bf4be9b3cca602b7f48794e39
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dberr.txt
                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                • Size 71KB
                                • SHA256 2206d23bfbdb9ef64f3d4fe651937ede8bb57a697cb79c825ecff62c0e03952d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dberr.txt
                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                • Size 71KB
                                • SHA256 2f51e12172b26b27583d80158c7288aab283fa7db0412b3df6c29117fb7a477a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dberr.txt
                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                • Size 71KB
                                • SHA256 e4bce71dc6d4fb8acefa03f5813e11892b903e5e1954c5e4caa727a23314aca0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dberr.txt
                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                • Size 71KB
                                • SHA256 7d644353486e363fab4dbaf435af17fdc6b256a35320014f5126abc3ccfa6f15
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dberr.txt
                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                • Size 71KB
                                • SHA256 d0f5cd2c3cbca83ada5d89088118905f3b1ace35a0710ed9300cf8f16633a918
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dberr.txt
                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                • Size 71KB
                                • SHA256 cb37cd8732d27ec8a241d3abb657cc7d9ed6ebf95252a5bb9db794e515cf2762
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                qcfilter.inf_amd64_afb4df27bf37e5d2.ini
                                • Path C:\Windows\System32\DriverStore\FileRepository\qcfilter.inf_amd64_afb4df27bf37e5d2.ini
                                • Size 437B
                                • SHA256 f53d23906c114a2c4bb3eb1ba765b014ede2c4dd72547a3d0355e0bb655c1bd4
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                qcmdm.inf_amd64_86d0444f2a27bb9f.ini
                                • Path C:\Windows\System32\DriverStore\FileRepository\qcmdm.inf_amd64_86d0444f2a27bb9f.ini
                                • Size 426B
                                • SHA256 0018804c182370fab934e703a16cdfbf7ae5e0afea9fd421cf94c6653c53a3f5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                qcwwan.inf_amd64_808b75773fb87a2b.ini
                                • Path C:\Windows\System32\DriverStore\FileRepository\qcwwan.inf_amd64_808b75773fb87a2b.ini
                                • Size 432B
                                • SHA256 baedf5a7c8db7e16cb7d3efbabaeaf91fc229c24bc4e9c907223922da88abb4a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                ssh-agent.exe
                                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                • Size 1.8MB
                                • SHA256 54f72c66a1523490bb13618eaa08440fb1394c06072cfa454b0eb89b4c68d026
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ReFsDedupSvc.exe
                                • Path C:\Windows\System32\ReFsDedupSvc.exe
                                • Size 2.6MB
                                • SHA256 c2bf8b65ac282efcaab8e2fcfe866b325aced070978be5b8a0a7a6220f7c3991
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SearchIndexer.exe
                                • Path C:\Windows\System32\SearchIndexer.exe
                                • Size 1.4MB
                                • SHA256 8269424ea2f7738b9f138d617e0e68159fa3dd8776f7a76afae1a4f3804ec7df
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SensorDataService.exe
                                • Path C:\Windows\System32\SensorDataService.exe
                                • Size 1.7MB
                                • SHA256 8f1d5feaddd1b9262f762c0a6e155fe4c22c353c9f14501f1e1e43a063af164f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VSSVC.exe
                                • Path C:\Windows\System32\VSSVC.exe
                                • Size 1.4MB
                                • SHA256 ca3f42b78aa915f7164964871f514b42b7a4dd01fe2bf92d6458e5549a5de4e6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dberr.txt
                                • Path C:\Windows\System32\catroot2\dberr.txt
                                • Size 71KB
                                • SHA256 f6a21ca040c7deea436f54f5dd688fd132cb17e6b24ba01d6d3581984c2c5895
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msiexec.exe
                                • Path C:\Windows\System32\msiexec.exe
                                • Size 176KB
                                • SHA256 5872fe75e96a1c653972421c5874e19ea6181a08bed623c269fd3576c2bb707e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AppVClient.exe
                                • Path C:\Windows\system32\AppVClient.exe
                                • Size 1.3MB
                                • SHA256 07464a9838d855d635e9375fa8516cb8021ff885bcae6caa723f1faf142e30bc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                PerceptionSimulationService.exe
                                • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                • Size 1.5MB
                                • SHA256 c3c8b5e28c411e9df86e4e22ea3d5e19252e92e673678449b48142ceb405505a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                metadata-2
                                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                • Size 26.1MB
                                • SHA256 1bbe900a2e7397d1c37e218741a0e1a62fe011e2689133ba5ce40ea5dd55fe81
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                {71025cfa-7dd2-4d78-8ef1-fa8e8895bfd4}_OnDiskSnapshotProp
                                • Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{71025cfa-7dd2-4d78-8ef1-fa8e8895bfd4}_OnDiskSnapshotProp
                                • Size 6KB
                                • SHA256 cf593e6620595a365922bf56c808912c6ceeb1d9bdbc8034fef2ba4567be508c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/696-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                Download

                                memory/696-129-0x0000000140000000-0x0000000140168000-memory.dmp
                                Download

                                memory/696-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                Download

                                memory/696-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                Download

                                memory/696-140-0x0000000140000000-0x0000000140168000-memory.dmp
                                Download

                                memory/1044-370-0x0000000140000000-0x0000000140172000-memory.dmp
                                Download

                                memory/1044-604-0x0000000140000000-0x0000000140172000-memory.dmp
                                Download

                                memory/1044-602-0x0000000000620000-0x0000000000680000-memory.dmp
                                Download

                                memory/1044-146-0x0000000140000000-0x0000000140172000-memory.dmp
                                Download

                                memory/1044-147-0x0000000000620000-0x0000000000680000-memory.dmp
                                Download

                                memory/1044-153-0x0000000000620000-0x0000000000680000-memory.dmp
                                Download

                                memory/1284-85-0x0000000000400000-0x00000000011A1000-memory.dmp
                                Download

                                memory/1284-556-0x0000000000400000-0x00000000011A1000-memory.dmp
                                Download

                                memory/1284-0-0x0000000003050000-0x00000000030B6000-memory.dmp
                                Download

                                memory/1284-8-0x0000000003050000-0x00000000030B6000-memory.dmp
                                Download

                                memory/1284-7-0x0000000000400000-0x00000000011A1000-memory.dmp
                                Download

                                memory/1884-23-0x0000000000E70000-0x0000000000ED0000-memory.dmp
                                Download

                                memory/1884-14-0x0000000140000000-0x00000001402E9000-memory.dmp
                                Download

                                memory/1884-15-0x0000000000E70000-0x0000000000ED0000-memory.dmp
                                Download

                                memory/1884-116-0x0000000140000000-0x00000001402E9000-memory.dmp
                                Download

                                memory/2328-575-0x0000000140000000-0x0000000140176000-memory.dmp
                                Download

                                memory/2328-316-0x0000000140000000-0x0000000140176000-memory.dmp
                                Download

                                memory/2328-70-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                Download

                                memory/2328-76-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                Download

                                memory/2328-563-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                Download

                                memory/2328-68-0x0000000140000000-0x0000000140176000-memory.dmp
                                Download

                                memory/2932-91-0x0000000140000000-0x00000001402C9000-memory.dmp
                                Download

                                memory/2932-331-0x0000000140000000-0x00000001402C9000-memory.dmp
                                Download

                                memory/2932-384-0x0000000140000000-0x00000001402C9000-memory.dmp
                                Download

                                memory/2932-382-0x00000000007F0000-0x0000000000850000-memory.dmp
                                Download

                                memory/2932-92-0x00000000007F0000-0x0000000000850000-memory.dmp
                                Download

                                memory/2932-98-0x00000000007F0000-0x0000000000850000-memory.dmp
                                Download

                                memory/3400-367-0x0000000000790000-0x00000000007F0000-memory.dmp
                                Download

                                memory/3400-110-0x0000000000790000-0x00000000007F0000-memory.dmp
                                Download

                                memory/3400-360-0x0000000140000000-0x00000001401BA000-memory.dmp
                                Download

                                memory/3400-369-0x0000000140000000-0x00000001401BA000-memory.dmp
                                Download

                                memory/3400-103-0x0000000140000000-0x00000001401BA000-memory.dmp
                                Download

                                memory/3400-104-0x0000000000790000-0x00000000007F0000-memory.dmp
                                Download

                                memory/4204-579-0x0000000140000000-0x000000014017A000-memory.dmp
                                Download

                                memory/4204-56-0x0000000140000000-0x000000014017A000-memory.dmp
                                Download

                                memory/4204-290-0x0000000140000000-0x000000014017A000-memory.dmp
                                Download

                                memory/4204-574-0x00000000008B0000-0x0000000000910000-memory.dmp
                                Download

                                memory/4204-58-0x00000000008B0000-0x0000000000910000-memory.dmp
                                Download

                                memory/4204-64-0x00000000008B0000-0x0000000000910000-memory.dmp
                                Download

                                memory/4808-28-0x00000000007E0000-0x0000000000840000-memory.dmp
                                Download

                                memory/4808-145-0x0000000140000000-0x00000001402D4000-memory.dmp
                                Download

                                memory/4808-27-0x0000000140000000-0x00000001402D4000-memory.dmp
                                Download

                                memory/4808-36-0x00000000007E0000-0x0000000000840000-memory.dmp
                                Download

                                memory/4896-124-0x0000000000950000-0x00000000009B0000-memory.dmp
                                Download

                                memory/4896-117-0x0000000140000000-0x00000001401E9000-memory.dmp
                                Download

                                memory/4896-118-0x0000000000950000-0x00000000009B0000-memory.dmp
                                Download

                                memory/4896-366-0x0000000140000000-0x00000001401E9000-memory.dmp
                                Download

                                memory/5020-80-0x0000000000780000-0x00000000007E6000-memory.dmp
                                Download

                                memory/5020-327-0x0000000000400000-0x0000000000542000-memory.dmp
                                Download

                                memory/5020-86-0x0000000000400000-0x0000000000542000-memory.dmp
                                Download

                                memory/5020-576-0x0000000000400000-0x0000000000542000-memory.dmp
                                Download

                                memory/5020-87-0x0000000000780000-0x00000000007E6000-memory.dmp
                                Download

                                memory/5772-41-0x0000000140000000-0x0000000140180000-memory.dmp
                                Download

                                memory/5772-55-0x0000000140000000-0x0000000140180000-memory.dmp
                                Download

                                memory/5772-42-0x0000000001B50000-0x0000000001BB0000-memory.dmp
                                Download

                                memory/5772-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp
                                Download

                                memory/5772-52-0x0000000001B50000-0x0000000001BB0000-memory.dmp
                                Download

                                memory/5852-335-0x0000000002DB0000-0x0000000002E39000-memory.dmp
                                Download

                                memory/5852-330-0x0000000002C40000-0x0000000002CE7000-memory.dmp
                                Download

                                memory/5852-328-0x0000000002C40000-0x0000000002CE7000-memory.dmp
                                Download

                                memory/5852-292-0x0000000010000000-0x00000000101B5000-memory.dmp
                                Download