Overview

overview

9

Static

static

3

2026-09-29...er.exe

windows10-2004-x64

2026-09-29...er.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    56s
  • max time network
    94s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 04:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-09-29_23fbac70ebcceb423ba8a535d345a19a_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe
  • Size 8.6MB
  • Sample260930-ew3aeawfrc
  • SHA256 8ef734d8aee664f126f30b4d36ada719d735af1a5bb54258d3102d5b8b52c144
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryevasionexecutionransomwarespywarestealer

Malware Config

Signatures

  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Drops file in Drivers directory 2 IoCs
  • Manipulates Digital Signatures 1 TTPs 2 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 54 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_23fbac70ebcceb423ba8a535d345a19a_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_23fbac70ebcceb423ba8a535d345a19a_darkgate_elex_icedid_rhadamanthys_smoke-loader.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c bcdedit.exe > "C:\Users\Admin\AppData\Local\Temp\usb75C3.tmp"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5808
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe
        3⤵
          PID:4324
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set testsigning on
        2⤵
        • Modifies boot configuration data using bcdedit
        PID:1376
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi" REBOOTNEEDED=1
        2⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4132
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      PID:4920
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4628
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3024
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:836
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3828
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1948
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4356
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:4768
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1120
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5032
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6000
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:4952
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:5704
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:3516
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 2920 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
            • Modifies data under HKEY_USERS
            PID:5740
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5988
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 56F66989608B7ECFEF7ED14568602E02 C
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5056
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{06307E20-A6EC-4223-B7F8-0F5FC64DB18B}
              3⤵
              • Executes dropped EXE
              PID:2940
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{085D7FAC-8C69-45FA-A7CC-717F9146BD99}
              3⤵
              • Executes dropped EXE
              PID:2768
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A93ADBA-B7CE-495D-8DAB-8F0E71C6F18B}
              3⤵
              • Executes dropped EXE
              PID:5364
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{62EB3C92-3F6D-4515-9EE4-898AAD323528}
              3⤵
              • Executes dropped EXE
              PID:4968
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C3BCFCFF-DEA0-47E2-AB16-2F5055F773F4}
              3⤵
              • Executes dropped EXE
              PID:1136
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5DF17164-6A9F-466E-A3A4-E21279CC91F7}
              3⤵
              • Executes dropped EXE
              PID:5344
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7B9BD5E9-3F81-41CF-AE0E-F6FFB0B3DF41}
              3⤵
              • Executes dropped EXE
              PID:5616
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C0E24D1-B49E-4D5A-90E7-FF2CDB53F04A}
              3⤵
              • Executes dropped EXE
              PID:2604
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DCDBD697-D7E5-4B94-9151-670938719602}
              3⤵
              • Executes dropped EXE
              PID:5460
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D82EB8FB-2003-4A29-99B1-7C7EA8DD990D}
              3⤵
              • Executes dropped EXE
              PID:3556
            • C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7263C1AF-5CA6-494B-9D57-1510ECD42B90}
              3⤵
              • Executes dropped EXE
              PID:6116
          • C:\Windows\system32\srtasks.exe
            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
            2⤵
              PID:3248
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 7F8F6BE3FB8331535DF4266DBCB95E86 E Global\MSI0000
              2⤵
              • Manipulates Digital Signatures
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5816
              • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\DriverInstaller64.exe
                "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\..\Tools\DriverInstaller64.exe" "/i|1|C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\
                3⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                PID:4280
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:1908
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64\qcser.inf" "9" "446711843" "000000000000019C" "WinSta0\Default" "0000000000000174" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64"
            1⤵
            • Manipulates Digital Signatures
            • Drops file in System32 directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:3820
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64\qcmdm.inf" "9" "4fdd37767" "0000000000000178" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64"
            1⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            PID:5796
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "1" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64\qcnet.inf" "9" "41964d3af" "0000000000000188" "WinSta0\Default" "0000000000000184" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64"
            1⤵
              PID:4404
            • C:\Windows\system32\LogonUI.exe
              "LogonUI.exe" /flags:0x4 /state0:0xa39c5855 /state1:0x41c64e6d
              1⤵
                PID:5044
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k GPSvcGroup
                1⤵
                  PID:1868
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k CameraMonitor
                  1⤵
                    PID:2432

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        e5a2d2d.rbs
                        • Path C:\Config.Msi\e5a2d2d.rbs
                        • Size 19KB
                        • SHA256 569480f68764d811acd649912065b281f40848bd0f633b72a1eb18e6bd73a770
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcusbnet.cat
                        • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\checked\amd64\qcusbnet.cat
                        • Size 3KB
                        • SHA256 2d416c0ee1719ff67c413b0ea32440b27da110f9ff0e0d8fb8efbca1363a69b6
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        qcusbnet.sys
                        • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\checked\amd64\qcusbnet.sys
                        • Size 499KB
                        • SHA256 006a71fcf1bbc0a974ab3200746b2fedb36a9e708e3e855aaa9aa30f1cb76117
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcusbser.cat
                        • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\checked\amd64\qcusbser.cat
                        • Size 4KB
                        • SHA256 13dc95ed460ae337b2c9ed4ea17574f3e6c3364571fbb41c02f30381ac34d128
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcusbser.sys
                        • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\checked\amd64\qcusbser.sys
                        • Size 361KB
                        • SHA256 13b4f8bb890734cd2ddd1623fbcba161fa6d62c7048c9a904fce65411bfcaa34
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        elevation_service.exe
                        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                        • Size 2.7MB
                        • SHA256 ac85d11c7e493d5f77a1742d8c3800d10dd737ea9b10db5dd25e6557152aec84
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        maintenanceservice.exe
                        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                        • Size 1.5MB
                        • SHA256 7df5028cd4c35c76a430d5cd14d6e62cb6049a71f874011d11c0b174362f2d80
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcusbtest.cer
                        • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\TestCertificate\qcusbtest.cer
                        • Size 580B
                        • SHA256 d7f2c685f0aadf936bf6cc96c8ff5a9bb79973c6a0bc9ddd98f30813f20760f6
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        DIFxAPI.dll
                        • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\DifxApi\amd64\DIFxAPI.dll
                        • Size 507KB
                        • SHA256 bf0798d3a4540b15f45c5b329798a2ac532ff693764948b9b4757265e145216e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        DriverInstaller64.exe
                        • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\DriverInstaller64.exe
                        • Size 2.2MB
                        • SHA256 a3d1c48ca59b82feb88d3be36a740600d41c229b3b3fe4aa26d09bceb0b5f44d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcmdm.inf
                        • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64\qcmdm.inf
                        • Size 24KB
                        • SHA256 f4e5db1097562912ad441fa83ae6c864d841f86132f69faaab9605e16e939360
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcnet.inf
                        • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64\qcnet.inf
                        • Size 29KB
                        • SHA256 03d3a46718cf93e089c8b50549a0056433022c4bf85071acf7bf09cff2eafadf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcser.inf
                        • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\checked\amd64\qcser.inf
                        • Size 47KB
                        • SHA256 efcbcb442ac9d24e6e39926ad80220748e1c90367b27b0b3abfedd731f6becbb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OSE.EXE
                        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                        • Size 1.5MB
                        • SHA256 9f043843bb9e73b48379191f2687af097173896bae275ddcd07db96c4fc1263e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        elevation_service.exe
                        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        • Size 2.8MB
                        • SHA256 219dffe7a1f29e34a0581bd4a21249605f35635bcf614084f398d9f436736c2d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MsSense.exe
                        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                        • Size 1.7MB
                        • SHA256 08835ec70c9981e66191336478269152bca0aa2e359ddc80d7f41318fcde8f22
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Windows.db
                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                        • Size 1.1MB
                        • SHA256 2b8c34e7674c4e46dc458b4f356cf1f81f5cf1a8f115717a8b045a1f5fe6c3da
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Windows.db
                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                        • Size 1.3MB
                        • SHA256 8b618b0e5cd198bfab915afb240af281d573892919904fbe6fc9198168e52bbe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Windows.db-wal
                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                        • Size 1.2MB
                        • SHA256 5bfa7dad2f5596275dad1ee09b9651d1e1bb884683c9390c79c53103e49d9c19
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MSI8C87.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\MSI8C87.tmp
                        • Size 1.3MB
                        • SHA256 2cbe8b514547da632f32f41e6ab14612c32c34f487330bc4e6ea53454b50a55c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QualcommWindowsDriverInstaller.msi
                        • Path C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi
                        • Size 6.6MB
                        • SHA256 cdaf03bb4c995b89f0397ff57f6332aab96093681215d4915dcf3a1627687158
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        usb75C3.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\usb75C3.tmp
                        • Size 1KB
                        • SHA256 f49774bf946bdc6df74df7203108f87fa9d6d92e7202a1d4b37f22b726a0ceb0
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ISBEW64.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISBEW64.exe
                        • Size 146KB
                        • SHA256 9acc6cb5d01a4e4dbc92c8774c6999fab5f0e49f097e83098ba740842f5a2894
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ISRT.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\ISRT.dll
                        • Size 260KB
                        • SHA256 e91a865c3d60d9d0bce5d5a0a2f551c5e032d5bc13bc40f85091ce46d38064e0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _isres_0x0409.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\{F949D4F8-5B67-4124-84B0-06C9FEA7AB99}\_isres_0x0409.dll
                        • Size 540KB
                        • SHA256 6366e18a8cbf609c9573f341004e5c2725c23a12973affa90ee7bcc7934ae1b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MSI355A.tmp
                        • Path C:\Windows\Installer\MSI355A.tmp
                        • Size 1.6MB
                        • SHA256 8b10c6480c9cdda4597984619e1816fbf326a099acae0a71823a558907518107
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        perfhost.exe
                        • Path C:\Windows\SysWOW64\perfhost.exe
                        • Size 1.2MB
                        • SHA256 74c2ae87f343f7fefd94a838dd3f9e62df842496f5445a5c13a6578c19f7c0d2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AgentService.exe
                        • Path C:\Windows\System32\AgentService.exe
                        • Size 1.4MB
                        • SHA256 f4f4db894c390d5bb12252c866cd4884f7527f81b8ea3d6f6a8c2ac997bdde68
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dberr.txt
                        • Path C:\Windows\System32\CatRoot2\dberr.txt
                        • Size 70KB
                        • SHA256 de633f54cd4034162cd9f62a0cf93e0c5a21a44edef3421d71aae2fbd711e35a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dberr.txt
                        • Path C:\Windows\System32\CatRoot2\dberr.txt
                        • Size 70KB
                        • SHA256 ac163967dd45b5c42499a077fe58f2b55e8a4b6c575fb6a6e29d4ddd65b70269
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dberr.txt
                        • Path C:\Windows\System32\CatRoot2\dberr.txt
                        • Size 70KB
                        • SHA256 caee2ca586170b033516b13c04434c24d73517ce2db55e91ce7b9bf7b89dd95d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dberr.txt
                        • Path C:\Windows\System32\CatRoot2\dberr.txt
                        • Size 71KB
                        • SHA256 136dfcd5c8d06ef53ea6fd3584720040a08306ee59df85a9b4c3321ba5746c2b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qcnet.inf_amd64_451e8530f7ccee5d.ini
                        • Path C:\Windows\System32\DriverStore\FileRepository\qcnet.inf_amd64_451e8530f7ccee5d.ini
                        • Size 415B
                        • SHA256 b4968a71aeff66147b58e24c327a4f743469345121b4e950708766d4956cd60a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        qcser.inf_amd64_a38de8285c46bafa.ini
                        • Path C:\Windows\System32\DriverStore\FileRepository\qcser.inf_amd64_a38de8285c46bafa.ini
                        • Size 415B
                        • SHA256 e5328a69b81d1fe2a3f26586b2f60e428bae811870a8589b0eebeeeab6b5e1b1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ssh-agent.exe
                        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                        • Size 1.8MB
                        • SHA256 be9914d31aa8624df6330696c9a92c80a1eb1da5b810fc0552d42049cde03128
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ReFsDedupSvc.exe
                        • Path C:\Windows\System32\ReFsDedupSvc.exe
                        • Size 2.6MB
                        • SHA256 a30fb68f69d8a236e248dd7695e72d3b3ce59e81ff2df92387d55b4d30e25673
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SearchIndexer.exe
                        • Path C:\Windows\System32\SearchIndexer.exe
                        • Size 1.4MB
                        • SHA256 cd549fdb329916a6ff85ca1bfb4057c6d199e4d0cd53de52493468a929031ba3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SensorDataService.exe
                        • Path C:\Windows\System32\SensorDataService.exe
                        • Size 1.7MB
                        • SHA256 5b5d7894b2c91e0ca2403fd42fc98cc6fc07a234e2fe0c441ef1051d04ba7c4a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VSSVC.exe
                        • Path C:\Windows\System32\VSSVC.exe
                        • Size 1.4MB
                        • SHA256 ca3f42b78aa915f7164964871f514b42b7a4dd01fe2bf92d6458e5549a5de4e6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dberr.txt
                        • Path C:\Windows\System32\catroot2\dberr.txt
                        • Size 70KB
                        • SHA256 704fda5e2dc416bc1ac10371a5d3f95f181cc5fef913903cf3b64bb206b2e6bc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        msiexec.exe
                        • Path C:\Windows\System32\msiexec.exe
                        • Size 176KB
                        • SHA256 5872fe75e96a1c653972421c5874e19ea6181a08bed623c269fd3576c2bb707e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AppVClient.exe
                        • Path C:\Windows\system32\AppVClient.exe
                        • Size 1.3MB
                        • SHA256 384074ccd8d30f36fd0d246ccec97a4ee58a33a3c3605ea6935974b4e4d53b9d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        PerceptionSimulationService.exe
                        • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                        • Size 1.5MB
                        • SHA256 af5f55c7a781aee8dac2a6548db522040a90621c3f73715f33a71bb86b188c68
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SgrmBroker.exe
                        • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                        • Size 1.6MB
                        • SHA256 dba028922d73b23e564d264b99a3e2619b2c231dfe2a09ea52cfda575b968e92
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        metadata-2
                        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                        • Size 26.1MB
                        • SHA256 998223b870980ea2c5a3b3d4ee1be8494bedba703f062f605ebc29d256a6d189
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        {2db376e3-e55d-4e68-9509-793655d56abe}_OnDiskSnapshotProp
                        • Path \??\Volume{804c0bee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2db376e3-e55d-4e68-9509-793655d56abe}_OnDiskSnapshotProp
                        • Size 6KB
                        • SHA256 89b6fbb099bc1e5fadfcfa4b768d9303da45d612f072a4f817afa623b154e596
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/836-55-0x0000000000880000-0x00000000008E0000-memory.dmp
                        Download

                        memory/836-54-0x0000000140000000-0x000000014017A000-memory.dmp
                        Download

                        memory/836-1103-0x0000000140000000-0x000000014017A000-memory.dmp
                        Download

                        memory/836-1098-0x0000000000880000-0x00000000008E0000-memory.dmp
                        Download

                        memory/836-177-0x0000000140000000-0x000000014017A000-memory.dmp
                        Download

                        memory/836-61-0x0000000000880000-0x00000000008E0000-memory.dmp
                        Download

                        memory/1120-113-0x0000000140000000-0x00000001401E9000-memory.dmp
                        Download

                        memory/1120-121-0x0000000000D00000-0x0000000000D60000-memory.dmp
                        Download

                        memory/1120-346-0x0000000140000000-0x00000001401E9000-memory.dmp
                        Download

                        memory/1948-78-0x0000000000A00000-0x0000000000A66000-memory.dmp
                        Download

                        memory/1948-77-0x0000000000400000-0x0000000000542000-memory.dmp
                        Download

                        memory/1948-1100-0x0000000000400000-0x0000000000542000-memory.dmp
                        Download

                        memory/1948-83-0x0000000000A00000-0x0000000000A66000-memory.dmp
                        Download

                        memory/1948-293-0x0000000000400000-0x0000000000542000-memory.dmp
                        Download

                        memory/3024-52-0x0000000140000000-0x0000000140180000-memory.dmp
                        Download

                        memory/3024-46-0x0000000001850000-0x00000000018B0000-memory.dmp
                        Download

                        memory/3024-40-0x0000000001850000-0x00000000018B0000-memory.dmp
                        Download

                        memory/3024-39-0x0000000140000000-0x0000000140180000-memory.dmp
                        Download

                        memory/3024-50-0x0000000001850000-0x00000000018B0000-memory.dmp
                        Download

                        memory/3828-67-0x0000000000C10000-0x0000000000C70000-memory.dmp
                        Download

                        memory/3828-1104-0x0000000140000000-0x0000000140176000-memory.dmp
                        Download

                        memory/3828-1096-0x0000000000C10000-0x0000000000C70000-memory.dmp
                        Download

                        memory/3828-65-0x0000000140000000-0x0000000140176000-memory.dmp
                        Download

                        memory/3828-73-0x0000000000C10000-0x0000000000C70000-memory.dmp
                        Download

                        memory/3828-208-0x0000000140000000-0x0000000140176000-memory.dmp
                        Download

                        memory/4356-384-0x0000000000760000-0x00000000007C0000-memory.dmp
                        Download

                        memory/4356-95-0x0000000000760000-0x00000000007C0000-memory.dmp
                        Download

                        memory/4356-312-0x0000000140000000-0x00000001402C9000-memory.dmp
                        Download

                        memory/4356-94-0x0000000140000000-0x00000001402C9000-memory.dmp
                        Download

                        memory/4356-385-0x0000000140000000-0x00000001402C9000-memory.dmp
                        Download

                        memory/4356-87-0x0000000000760000-0x00000000007C0000-memory.dmp
                        Download

                        memory/4628-138-0x0000000140000000-0x00000001402D4000-memory.dmp
                        Download

                        memory/4628-28-0x00000000006E0000-0x0000000000740000-memory.dmp
                        Download

                        memory/4628-36-0x00000000006E0000-0x0000000000740000-memory.dmp
                        Download

                        memory/4628-27-0x0000000140000000-0x00000001402D4000-memory.dmp
                        Download

                        memory/4768-102-0x0000000000820000-0x0000000000880000-memory.dmp
                        Download

                        memory/4768-108-0x0000000000820000-0x0000000000880000-memory.dmp
                        Download

                        memory/4768-369-0x0000000140000000-0x00000001401BA000-memory.dmp
                        Download

                        memory/4768-101-0x0000000140000000-0x00000001401BA000-memory.dmp
                        Download

                        memory/4768-315-0x0000000140000000-0x00000001401BA000-memory.dmp
                        Download

                        memory/4768-367-0x0000000000820000-0x0000000000880000-memory.dmp
                        Download

                        memory/4920-14-0x0000000000D00000-0x0000000000D60000-memory.dmp
                        Download

                        memory/4920-23-0x0000000000D00000-0x0000000000D60000-memory.dmp
                        Download

                        memory/4920-100-0x0000000140000000-0x00000001402E9000-memory.dmp
                        Download

                        memory/4920-20-0x0000000140000000-0x00000001402E9000-memory.dmp
                        Download

                        memory/5032-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                        Download

                        memory/5032-141-0x0000000140000000-0x0000000140168000-memory.dmp
                        Download

                        memory/5032-126-0x0000000140000000-0x0000000140168000-memory.dmp
                        Download

                        memory/5032-139-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                        Download

                        memory/5032-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                        Download

                        memory/5056-210-0x0000000010000000-0x00000000101B5000-memory.dmp
                        Download

                        memory/5056-319-0x0000000003310000-0x0000000003399000-memory.dmp
                        Download

                        memory/5056-314-0x0000000003130000-0x00000000031D7000-memory.dmp
                        Download

                        memory/5104-93-0x0000000000400000-0x0000000000CA8000-memory.dmp
                        Download

                        memory/5104-1078-0x0000000000400000-0x0000000000CA8000-memory.dmp
                        Download

                        memory/5104-0-0x0000000000400000-0x0000000000CA8000-memory.dmp
                        Download

                        memory/5104-8-0x0000000002A40000-0x0000000002AA6000-memory.dmp
                        Download

                        memory/5104-1-0x0000000002A40000-0x0000000002AA6000-memory.dmp
                        Download

                        memory/5740-381-0x00000274EA680000-0x00000274EA90B000-memory.dmp
                        Download

                        memory/6000-146-0x0000000140000000-0x0000000140172000-memory.dmp
                        Download

                        memory/6000-153-0x0000000000620000-0x0000000000680000-memory.dmp
                        Download

                        memory/6000-147-0x0000000000620000-0x0000000000680000-memory.dmp
                        Download

                        memory/6000-370-0x0000000140000000-0x0000000140172000-memory.dmp
                        Download

                        memory/6000-1128-0x0000000000620000-0x0000000000680000-memory.dmp
                        Download

                        memory/6000-1130-0x0000000140000000-0x0000000140172000-memory.dmp
                        Download