Overview

overview

7

Static

static

3

QPST_2.7.4...on.url

windows10-2004-x64

1

QPST_2.7.4...on.url

windows11-ltsc_2024-x64

1

QPST_2.7.4...er.url

windows10-2004-x64

1

QPST_2.7.4...er.url

windows11-ltsc_2024-x64

1

QPST_2.7.4...er.url

windows10-2004-x64

1

QPST_2.7.4...er.url

windows11-ltsc_2024-x64

1

QPST_2.7.4...se.url

windows10-2004-x64

1

QPST_2.7.4...se.url

windows11-ltsc_2024-x64

1

QPST_2.7.4...te.url

windows10-2004-x64

1

QPST_2.7.4...te.url

windows11-ltsc_2024-x64

1

QPST_2.7.4....1.exe

windows10-2004-x64

7

QPST_2.7.4....1.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    QPST_2.7.496/QPST.2.7.496.1.exe
  • Size 32.2MB
  • Sample260930-wthlnaef83
  • SHA256 191b6784c9eb56b7269327348ca32a2e180411eb02f6c5e615e36cb43bcf4981
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\QPST_2.7.496\QPST.2.7.496.1.exe
    "C:\Users\Admin\AppData\Local\Temp\QPST_2.7.496\QPST.2.7.496.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe
      C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe /clone_wait
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\QpstTempInstaller.exe
        C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\QpstTempInstaller.exe /q"C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}" /clone_wait /IS_temp
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe
          "C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe" /q
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe
            "C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe" /q -burn.unelevated BurnPipe.{FB9013E4-408A-4C1B-A097-96FC8F53AEBE} {A2F8961E-B48B-4185-9609-E9BDCB8F7B34} 2044
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:5012
        • C:\Windows\SysWOW64\MSIEXEC.EXE
          "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\QPST 2.7.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="QpstTempInstaller.exe"
          4⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3176
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\system32\explorer.exe
          4⤵
            PID:3124
    • C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe" /clone_wait"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\QpstTempInstaller.exe
        C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\QpstTempInstaller.exe /q"C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}" /clone_wait" /IS_temp
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4212
        • C:\Windows\SysWOW64\MSIEXEC.EXE
          "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\QPST 2.7.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="QpstTempInstaller.exe"
          3⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2184
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\system32\explorer.exe
          3⤵
            PID:3728
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3812
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Windows\Installer\MSIC46F.tmp
          "C:\Windows\Installer\MSIC46F.tmp" /Install
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2344
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 35EDD72C9271607AE82540E14381BE78
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4356
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        1⤵
          PID:3736

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59bcfe.rbs
              • Path C:\Config.Msi\e59bcfe.rbs
              • Size 833KB
              • SHA256 2179f951f92dbbb321c80b3c88c155533b279bbeababf8d2b5afa80966d20cf8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e59bd00.rbs
              • Path C:\Config.Msi\e59bd00.rbs
              • Size 1005KB
              • SHA256 d03220261bf21688a037e6ab111e99675e23d38185f92c1711f3e278e1a13353
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Scramp.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\Scramp\Scramp.exe
              • Size 38KB
              • SHA256 b1ba9628ebf8c930d68dda42cc69b7f15ac29ce899d30992adf6e27dcb1518ad
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtmnServer.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe
              • Size 3.7MB
              • SHA256 dae2fb61defe68b2b999f6cce935eb1427abb5a10996cf4f49511a47e7a081ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtmnServer.tlb
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.tlb
              • Size 3KB
              • SHA256 1a8e998c4a68a72eefcd08eafdcab332b3531997a385b62c5093af6b0a1a50c0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ConfigAgentLib.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentLib.dll
              • Size 156KB
              • SHA256 41392f26f6f3f4962cbb21857ccb964f1f9536d53f453782aedd9f89a0e32fb8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ConfigAgentMarshal.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentMarshal.dll
              • Size 13KB
              • SHA256 be24ca0c9b561a1c77663f4ffe65957c369febfa5235df99c9ed172fed025486
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Download.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\Download.exe
              • Size 2.1MB
              • SHA256 7779cb98d7760a7741e5d8e53d52049b533160bc30317eaaa2778b628e105b36
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DownloadAgentLib.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\DownloadAgentLib.dll
              • Size 1.9MB
              • SHA256 e33e6e252592d6be69389b1320706763338d3d58f96e5de5185f14438b2c660c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              EFSExpCtrl.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExpCtrl.dll
              • Size 1.5MB
              • SHA256 3a0a36bab1f8ac4ecaa91f103bd225a0dfc3f4644ba554ffd3dacfa98ae43af0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              EFSExplorer.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExplorer.exe
              • Size 1.4MB
              • SHA256 3902e1b58f0c2e4eab20bc7aceadd05593082be749b1c1ae54a2848480bceb92
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MemoryDebugApp.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\MemoryDebugApp.exe
              • Size 1.1MB
              • SHA256 d13691de74632870ebc361e775e503c71816d42a78cc6d913ef961df55f1dc20
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhoneEFS.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneEFS.dll
              • Size 1009KB
              • SHA256 6b250c318c0959bb4dea0cced1cb516f84f827b86731eed2406dd11f8eed84a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhoneLib.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneLib.dll
              • Size 2.1MB
              • SHA256 c5039094daeac676545baf843c9585a5cfb76b4a39846f927a01787b75c9a529
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhoneMarshal.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneMarshal.dll
              • Size 21KB
              • SHA256 062b82dbd9053e798545823ed29596a0bf9e7cb887ebcddeaa370238ae075142
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhoneModelLib.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneModelLib.dll
              • Size 781KB
              • SHA256 9ee773372313ea855abfe4c4c9309e7e84cc4a1759564511a65c77f64b88dfed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhonePropLib1.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib1.dll
              • Size 43KB
              • SHA256 facc31bbb0c48ceaa8e902fe2c08690c878daa4e427a6fb2a79fabdd66de36d7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhonePropLib2.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib2.dll
              • Size 182KB
              • SHA256 0ccff8b7538f9dedcee11d3d7d8a2314f0720046c929bb7fcded0c23d2854cb6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhonePropLib3.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib3.dll
              • Size 604KB
              • SHA256 c582ebd65e8521bf302f00c28d94a78999ce687871b21e0c9ca630c2f962eda0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhonePropLib4.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib4.dll
              • Size 503KB
              • SHA256 3769bbe235aa70749e7526177bee452957aeaa8fbe11c652ddbfc3e96b7fea86
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PhonePropLib5.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib5.dll
              • Size 233KB
              • SHA256 f0b0a6ca486a14002bebebcddcabc40d325e679fd9139a64dec756aec255668d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QC.QMSLPhone.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QC.QMSLPhone.dll
              • Size 577KB
              • SHA256 f120274560cf19ae0ed432bbe0e3ad3114ebb70008ea70bb0f234249ec51f77f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QCNView.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QCNView.exe
              • Size 4.3MB
              • SHA256 c8d513ff1ef910e287d9762454a008c7ef4e8b50aeb78e02374a4a879a728e5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QDmssLoader.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QDmssLoader.exe
              • Size 16KB
              • SHA256 005f39bbe88bfdd97369ad82f164ddd07055b3c8c313f76104706b135cfbde44
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QFIL.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QFIL.exe
              • Size 143KB
              • SHA256 d1bd8afb979345749107000f9d22b2239f749c12c1a8ec504d326d75999dfb69
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QMSL_MSVC10R.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QMSL_MSVC10R.dll
              • Size 17.1MB
              • SHA256 2e2adc9ac0cd914ebc8e0816f37b633c7d3575092e59fd1fb7db2d31f7355787
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTConfig.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe
              • Size 1.4MB
              • SHA256 e47cbf134e76405a03c6adc51926c208ea59288e27a09db0e0d080bf3b54af15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTProxyComponents.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.dll
              • Size 5.5MB
              • SHA256 fe101ae0be416914670ed8a5625b074ed0891496e1075bed1b321bd21ea927c7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTProxyComponents.tlb
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.tlb
              • Size 34KB
              • SHA256 19420a9d5a5cd5ca34ae3281cc42f686252b2df04cf7ab5f925d3dfe9312de6e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTServer.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe
              • Size 5.6MB
              • SHA256 14c4575859dc92200cd22d5c9f4c22a4d626d76f9ed837908c1d010296eae4e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTService.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe
              • Size 72KB
              • SHA256 a8673d9ea01cddda1e377f8ce3b147a7f59e75dc6b68387b56372607bfc152bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTServicePS.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServicePS.dll
              • Size 10KB
              • SHA256 d4623cac45166b9b38acf1c7692104f0b7e61c6f5d3b2b9277568de54165ab4d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTools.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools.dll
              • Size 1.3MB
              • SHA256 bce46dbd84270e554d579caffa94bf57741cc1619008bf5411c54a86bed2b0ec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTools2.ocx
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools2.ocx
              • Size 43KB
              • SHA256 98efc8c2092e7c947f8031f2ce5b4bef942807c23173ce7da8927b40198ceb04
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QSaharaServer.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe
              • Size 172KB
              • SHA256 42a5cdd3daa1798099625962a569a72656f28dd7d408be0e532bb12ee35ec4aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QpstMarshal.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QpstMarshal.dll
              • Size 41KB
              • SHA256 89b56dab32262881d714eca2ccf47de9ddf45b4b2ed6e82c9ff9527ff42f6bab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QpstVerCtrl.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QpstVerCtrl.dll
              • Size 6KB
              • SHA256 6116088c7a666eb62d6b6a050114ade5fcfc271bb957b9e8551cab83c6af4f34
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QualCtrl.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QualCtrl.dll
              • Size 79KB
              • SHA256 e90dc5ba0d4e4acfe99ba4cb879e0bd78e3d02584e6a307208296e36475173e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SerialPortLib.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\SerialPortLib.dll
              • Size 4.5MB
              • SHA256 ee609726c82ff5eaf242a5a570d27ab4fa695d6a2f028c555bcd587007600f4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ServiceProg.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProg.exe
              • Size 3.4MB
              • SHA256 444ff87676588dcc3e6d6e6ea5535418006ba3efa764a5778c2b5cba5518be5d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ServiceProgAgentLib.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProgAgentLib.dll
              • Size 118KB
              • SHA256 67074db186fed8c8a5777ed84769ca8213c3ed08f1275e694f8bbb8a0df238ed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SwDownloadDLL.dll
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\SwDownloadDLL.dll
              • Size 231KB
              • SHA256 284560f21c92a10ee633ed83063634d3388d2c113a9ca5b712ca8fd0f0395ac5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              emmcswdownload.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\emmcswdownload.exe
              • Size 1.9MB
              • SHA256 50f21e53d74ec263398446c8e5b4f825f45c7fbf892d45d9263b217bd0f00e41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              fh_loader.exe
              • Path C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe
              • Size 548KB
              • SHA256 dea55ec366c9b9a85c6b16b91b6796d8bace3c834850d7307ae17cacb91c5145
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QPSTServer.png
              • Path C:\Users\Admin\AppData\Local\Temp\QPSTServer.png
              • Size 27KB
              • SHA256 310d58b86750484761958f881e2409a83e4d1dc43da604d3eeaa07454f7c5668
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QpstTempInstaller.exe
              • Path C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe
              • Size 28.5MB
              • SHA256 da22bebb0a70a311460f51a02a7406b11c2cc4e253a9840b0538eae81ab5429f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _is1EC..dll
              • Path C:\Users\Admin\AppData\Local\Temp\_is1EC..dll
              • Size 2.5MB
              • SHA256 580467f266bd2e7c69a6ee288bcad2a1c843b4a0571a0df68ad2c15a4cfed691
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSXML 6.0 SP1.prq
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\MSXML 6.0 SP1.prq
              • Size 1KB
              • SHA256 e5bfb83faadd5b2a5ad51961b685aaf1e41918ef03d9f8ba3cd21858ac15a3eb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Microsoft Visual C++ 2010 SP1 Redistributable Package (x86).prq
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\Microsoft Visual C++ 2010 SP1 Redistributable Package (x86).prq
              • Size 2KB
              • SHA256 aa2f76e8228e63e45118f6d98923769b61c97ba4aca5a68181823776aa91345e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              QPST 2.7.msi
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\QPST 2.7.msi
              • Size 16.6MB
              • SHA256 edb111bda47846edb57a4e62563a509a774fa1ebeee7460f4d00cec31dc03182
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC++ 2013 Redistributable Package (x86).prq
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\VC++ 2013 Redistributable Package (x86).prq
              • Size 1KB
              • SHA256 95811f397a4d7b2eff66f4201c9353160e46f7955e2c77ed4683a0a3e47a4c06
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Windows Installer 3.1 (x86).prq
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\Windows Installer 3.1 (x86).prq
              • Size 1KB
              • SHA256 7c452695e76e194d70eeaaf791b5a29354c268918169da3f849d87eebad5f4c3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\_ISMSIDEL.INI
              • Size 640B
              • SHA256 b82052b24144cc6cc8a3415370510d211c13dfad7dbffdc46e20593545ef3fda
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\_ISMSIDEL.INI
              • Size 2KB
              • SHA256 8815318bfd24c4dacdf413f7c7af8851fe5931e6c8ebe7fab9662a0ec3eaccfa
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\_ISMSIDEL.INI
              • Size 2KB
              • SHA256 e49002330207c67b2a70b184f61af932869e08f90408cd332510178145d75193
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{09F05484-73D4-4E8D-B86E-EBED3C82A214}\_ISMSIDEL.INI
              • Size 20B
              • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
              • MD5 SHA1 SHA512
              Submit Download

              0x0409.ini
              • Path C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\0x0409.ini
              • Size 21KB
              • SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Setup.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\Setup.INI
              • Size 5KB
              • SHA256 16e731fc2523a3da4fb1a6d06b7f78c5f8dfe343489238fbce759d435fd18244
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\_ISMSIDEL.INI
              • Size 640B
              • SHA256 a3e7c6dd5687c39dcf963190b3153dc1402778e9c201fa61f80cfc77c3a9d707
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\_ISMSIDEL.INI
              • Size 832B
              • SHA256 3a2df6a4d3ec49f0363a7a5193a6284ab9455ffa9ff4855fff55b9d0f63620ff
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\_ISMSIDEL.INI
              • Size 350B
              • SHA256 5c630aa84bc78732f001f0bd1f09f7c93dba86ea89094a115438a19d8b35f33f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\_ISMSIDEL.INI
              • Size 46B
              • SHA256 06d38311dc59cf5a078491d01fe65e579b3c5d72764bf93e35ae24cd74a805be
              • MD5 SHA1 SHA512
              Submit Download

              vcredist_x86.exe
              • Path C:\Users\Admin\AppData\Local\Temp\{0A933480-F0DE-4346-A564-F03FC931894D}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe
              • Size 6.2MB
              • SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll
              • Size 117KB
              • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIC46F.tmp
              • Path C:\Windows\Installer\MSIC46F.tmp
              • Size 13KB
              • SHA256 fbd6bbf2cbe3f09b32844f856d9461605f0a008162c3a46da773b6454ba96f4b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSICE74.tmp
              • Path C:\Windows\Installer\MSICE74.tmp
              • Size 97KB
              • SHA256 3a50e7aff840c6c5ed14052f35e1414aa2c20aae6f96dba315b0fae68de37d0f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ARPPRODUCTICON.exe
              • Path C:\Windows\Installer\{B3305241-A2F4-4625-A3ED-45CF5E905A7A}\ARPPRODUCTICON.exe
              • Size 40KB
              • SHA256 b16de8874c6c37c8952efb424e87d20cd510524fcf0c9e5ffe3ac6da68b6dbbb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NewShortcut8_1.A02ED2FB_C587_4852_9041_F8BE9D9F3B36.exe
              • Path C:\Windows\Installer\{B3305241-A2F4-4625-A3ED-45CF5E905A7A}\NewShortcut8_1.A02ED2FB_C587_4852_9041_F8BE9D9F3B36.exe
              • Size 48KB
              • SHA256 1c9ec8e17d40d048551e47686bfeaa3513eb310e0259b2f9a2e4f8a437dd7cf9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download