Overview

overview

7

Static

static

3

QPST_2.7.4...on.url

windows10-2004-x64

1

QPST_2.7.4...on.url

windows11-ltsc_2024-x64

1

QPST_2.7.4...er.url

windows10-2004-x64

1

QPST_2.7.4...er.url

windows11-ltsc_2024-x64

1

QPST_2.7.4...er.url

windows10-2004-x64

1

QPST_2.7.4...er.url

windows11-ltsc_2024-x64

1

QPST_2.7.4...se.url

windows10-2004-x64

1

QPST_2.7.4...se.url

windows11-ltsc_2024-x64

1

QPST_2.7.4...te.url

windows10-2004-x64

1

QPST_2.7.4...te.url

windows11-ltsc_2024-x64

1

QPST_2.7.4....1.exe

windows10-2004-x64

7

QPST_2.7.4....1.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    QPST_2.7.496/QPST.2.7.496.1.exe
  • Size 32.2MB
  • Sample260930-wthlnaef83
  • SHA256 191b6784c9eb56b7269327348ca32a2e180411eb02f6c5e615e36cb43bcf4981
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 39 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\QPST_2.7.496\QPST.2.7.496.1.exe
    "C:\Users\Admin\AppData\Local\Temp\QPST_2.7.496\QPST.2.7.496.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:936
    • C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe
      C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe /clone_wait
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5580
      • C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\QpstTempInstaller.exe
        C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\QpstTempInstaller.exe /q"C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}" /clone_wait /IS_temp
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5780
        • C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe
          "C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe" /q
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3464
          • C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe
            "C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe" /q -burn.unelevated BurnPipe.{25685646-3E02-4350-9DF2-29D14BAAA060} {1203DEC3-8DE2-476C-B12B-50908DFF9CF5} 3464
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2880
        • C:\Windows\SysWOW64\MSIEXEC.EXE
          "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\QPST 2.7.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="QpstTempInstaller.exe"
          4⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:1956
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\system32\explorer.exe
          4⤵
            PID:1428
    • C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe" /clone_wait"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\QpstTempInstaller.exe
        C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\QpstTempInstaller.exe /q"C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}" /clone_wait" /IS_temp
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\SysWOW64\MSIEXEC.EXE
          "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\QPST 2.7.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="QpstTempInstaller.exe"
          3⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:592
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\system32\explorer.exe
          3⤵
            PID:3508
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:2012
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3664
        • C:\Windows\Installer\MSIAFE.tmp
          "C:\Windows\Installer\MSIAFE.tmp" /Install
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5752
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 5D060F5E6634B7F25258EAD1DD7903A5
          2⤵
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4568
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3348

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a05de.rbs
            • Path C:\Config.Msi\e5a05de.rbs
            • Size 833KB
            • SHA256 6fa20c6b265e033788d518d6b8f9a15f4ecef753dbd95eaae43f65756da65486
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a05e0.rbs
            • Path C:\Config.Msi\e5a05e0.rbs
            • Size 1005KB
            • SHA256 26713bf89cfcde3710cc72c4131e55bb57325fee9aa07c74f70c7b9a1cb6dc17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Scramp.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\Scramp\Scramp.exe
            • Size 38KB
            • SHA256 b1ba9628ebf8c930d68dda42cc69b7f15ac29ce899d30992adf6e27dcb1518ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AtmnServer.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.exe
            • Size 3.7MB
            • SHA256 dae2fb61defe68b2b999f6cce935eb1427abb5a10996cf4f49511a47e7a081ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AtmnServer.tlb
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\AtmnServer.tlb
            • Size 3KB
            • SHA256 1a8e998c4a68a72eefcd08eafdcab332b3531997a385b62c5093af6b0a1a50c0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ConfigAgentLib.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentLib.dll
            • Size 156KB
            • SHA256 41392f26f6f3f4962cbb21857ccb964f1f9536d53f453782aedd9f89a0e32fb8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ConfigAgentMarshal.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\ConfigAgentMarshal.dll
            • Size 13KB
            • SHA256 be24ca0c9b561a1c77663f4ffe65957c369febfa5235df99c9ed172fed025486
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Download.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\Download.exe
            • Size 2.1MB
            • SHA256 7779cb98d7760a7741e5d8e53d52049b533160bc30317eaaa2778b628e105b36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DownloadAgentLib.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\DownloadAgentLib.dll
            • Size 1.9MB
            • SHA256 e33e6e252592d6be69389b1320706763338d3d58f96e5de5185f14438b2c660c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EFSExpCtrl.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExpCtrl.dll
            • Size 1.5MB
            • SHA256 3a0a36bab1f8ac4ecaa91f103bd225a0dfc3f4644ba554ffd3dacfa98ae43af0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EFSExplorer.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\EFSExplorer.exe
            • Size 1.4MB
            • SHA256 3902e1b58f0c2e4eab20bc7aceadd05593082be749b1c1ae54a2848480bceb92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MemoryDebugApp.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\MemoryDebugApp.exe
            • Size 1.1MB
            • SHA256 d13691de74632870ebc361e775e503c71816d42a78cc6d913ef961df55f1dc20
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhoneEFS.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneEFS.dll
            • Size 1009KB
            • SHA256 6b250c318c0959bb4dea0cced1cb516f84f827b86731eed2406dd11f8eed84a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhoneLib.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneLib.dll
            • Size 2.1MB
            • SHA256 c5039094daeac676545baf843c9585a5cfb76b4a39846f927a01787b75c9a529
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhoneMarshal.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneMarshal.dll
            • Size 21KB
            • SHA256 062b82dbd9053e798545823ed29596a0bf9e7cb887ebcddeaa370238ae075142
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhoneModelLib.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhoneModelLib.dll
            • Size 781KB
            • SHA256 9ee773372313ea855abfe4c4c9309e7e84cc4a1759564511a65c77f64b88dfed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhonePropLib1.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib1.dll
            • Size 43KB
            • SHA256 facc31bbb0c48ceaa8e902fe2c08690c878daa4e427a6fb2a79fabdd66de36d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhonePropLib2.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib2.dll
            • Size 182KB
            • SHA256 0ccff8b7538f9dedcee11d3d7d8a2314f0720046c929bb7fcded0c23d2854cb6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhonePropLib3.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib3.dll
            • Size 604KB
            • SHA256 c582ebd65e8521bf302f00c28d94a78999ce687871b21e0c9ca630c2f962eda0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhonePropLib4.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib4.dll
            • Size 503KB
            • SHA256 3769bbe235aa70749e7526177bee452957aeaa8fbe11c652ddbfc3e96b7fea86
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PhonePropLib5.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\PhonePropLib5.dll
            • Size 233KB
            • SHA256 f0b0a6ca486a14002bebebcddcabc40d325e679fd9139a64dec756aec255668d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QC.QMSLPhone.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QC.QMSLPhone.dll
            • Size 577KB
            • SHA256 f120274560cf19ae0ed432bbe0e3ad3114ebb70008ea70bb0f234249ec51f77f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QCNView.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QCNView.exe
            • Size 4.3MB
            • SHA256 c8d513ff1ef910e287d9762454a008c7ef4e8b50aeb78e02374a4a879a728e5e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QDmssLoader.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QDmssLoader.exe
            • Size 16KB
            • SHA256 005f39bbe88bfdd97369ad82f164ddd07055b3c8c313f76104706b135cfbde44
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QFIL.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QFIL.exe
            • Size 143KB
            • SHA256 d1bd8afb979345749107000f9d22b2239f749c12c1a8ec504d326d75999dfb69
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QMSL_MSVC10R.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QMSL_MSVC10R.dll
            • Size 17.1MB
            • SHA256 2e2adc9ac0cd914ebc8e0816f37b633c7d3575092e59fd1fb7db2d31f7355787
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QPSTConfig.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe
            • Size 1.4MB
            • SHA256 e47cbf134e76405a03c6adc51926c208ea59288e27a09db0e0d080bf3b54af15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QPSTProxyComponents.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.dll
            • Size 5.5MB
            • SHA256 fe101ae0be416914670ed8a5625b074ed0891496e1075bed1b321bd21ea927c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QPSTProxyComponents.tlb
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTProxyComponents.tlb
            • Size 34KB
            • SHA256 19420a9d5a5cd5ca34ae3281cc42f686252b2df04cf7ab5f925d3dfe9312de6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QPSTServer.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServer.exe
            • Size 5.6MB
            • SHA256 14c4575859dc92200cd22d5c9f4c22a4d626d76f9ed837908c1d010296eae4e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QPSTService.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTService.exe
            • Size 72KB
            • SHA256 a8673d9ea01cddda1e377f8ce3b147a7f59e75dc6b68387b56372607bfc152bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QPSTServicePS.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTServicePS.dll
            • Size 10KB
            • SHA256 d4623cac45166b9b38acf1c7692104f0b7e61c6f5d3b2b9277568de54165ab4d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QPSTools.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools.dll
            • Size 1.3MB
            • SHA256 bce46dbd84270e554d579caffa94bf57741cc1619008bf5411c54a86bed2b0ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QPSTools2.ocx
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTools2.ocx
            • Size 43KB
            • SHA256 98efc8c2092e7c947f8031f2ce5b4bef942807c23173ce7da8927b40198ceb04
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QSaharaServer.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe
            • Size 172KB
            • SHA256 42a5cdd3daa1798099625962a569a72656f28dd7d408be0e532bb12ee35ec4aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QpstMarshal.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QpstMarshal.dll
            • Size 41KB
            • SHA256 89b56dab32262881d714eca2ccf47de9ddf45b4b2ed6e82c9ff9527ff42f6bab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QpstVerCtrl.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QpstVerCtrl.dll
            • Size 6KB
            • SHA256 6116088c7a666eb62d6b6a050114ade5fcfc271bb957b9e8551cab83c6af4f34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QualCtrl.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\QualCtrl.dll
            • Size 79KB
            • SHA256 e90dc5ba0d4e4acfe99ba4cb879e0bd78e3d02584e6a307208296e36475173e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SerialPortLib.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\SerialPortLib.dll
            • Size 4.5MB
            • SHA256 ee609726c82ff5eaf242a5a570d27ab4fa695d6a2f028c555bcd587007600f4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ServiceProg.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProg.exe
            • Size 3.4MB
            • SHA256 444ff87676588dcc3e6d6e6ea5535418006ba3efa764a5778c2b5cba5518be5d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ServiceProgAgentLib.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\ServiceProgAgentLib.dll
            • Size 118KB
            • SHA256 67074db186fed8c8a5777ed84769ca8213c3ed08f1275e694f8bbb8a0df238ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SwDownloadDLL.dll
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\SwDownloadDLL.dll
            • Size 231KB
            • SHA256 284560f21c92a10ee633ed83063634d3388d2c113a9ca5b712ca8fd0f0395ac5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            emmcswdownload.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\emmcswdownload.exe
            • Size 1.9MB
            • SHA256 50f21e53d74ec263398446c8e5b4f825f45c7fbf892d45d9263b217bd0f00e41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fh_loader.exe
            • Path C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe
            • Size 548KB
            • SHA256 dea55ec366c9b9a85c6b16b91b6796d8bace3c834850d7307ae17cacb91c5145
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QpstTempInstaller.exe
            • Path C:\Users\Admin\AppData\Local\Temp\QpstTempInstaller.exe
            • Size 28.5MB
            • SHA256 da22bebb0a70a311460f51a02a7406b11c2cc4e253a9840b0538eae81ab5429f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSXML 6.0 SP1.prq
            • Path C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\MSXML 6.0 SP1.prq
            • Size 1KB
            • SHA256 e5bfb83faadd5b2a5ad51961b685aaf1e41918ef03d9f8ba3cd21858ac15a3eb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft Visual C++ 2010 SP1 Redistributable Package (x86).prq
            • Path C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\Microsoft Visual C++ 2010 SP1 Redistributable Package (x86).prq
            • Size 2KB
            • SHA256 aa2f76e8228e63e45118f6d98923769b61c97ba4aca5a68181823776aa91345e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            QPST 2.7.msi
            • Path C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\QPST 2.7.msi
            • Size 16.6MB
            • SHA256 edb111bda47846edb57a4e62563a509a774fa1ebeee7460f4d00cec31dc03182
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VC++ 2013 Redistributable Package (x86).prq
            • Path C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\VC++ 2013 Redistributable Package (x86).prq
            • Size 1KB
            • SHA256 95811f397a4d7b2eff66f4201c9353160e46f7955e2c77ed4683a0a3e47a4c06
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows Installer 3.1 (x86).prq
            • Path C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\Windows Installer 3.1 (x86).prq
            • Size 1KB
            • SHA256 7c452695e76e194d70eeaaf791b5a29354c268918169da3f849d87eebad5f4c3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\_ISMSIDEL.INI
            • Size 832B
            • SHA256 e286abd99c84554ff532d7811c0b1cd338d93bd5ee3a93f0ce190d865f8d77a0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\_ISMSIDEL.INI
            • Size 20B
            • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
            • MD5 SHA1 SHA512
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{426DE671-900A-407D-B6EF-00438BE6C3A4}\_ISMSIDEL.INI
            • Size 640B
            • SHA256 18ecd58043a3f2bbba4ff66b528f149755b1d358292363f40f94223194efc708
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            0x0409.ini
            • Path C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\0x0409.ini
            • Size 21KB
            • SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Setup.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\Setup.INI
            • Size 5KB
            • SHA256 16e731fc2523a3da4fb1a6d06b7f78c5f8dfe343489238fbce759d435fd18244
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\_ISMSIDEL.INI
            • Size 832B
            • SHA256 c5069c67d3d58a2308b1fc9ec97203638cd47e9a792af8cfe68788c998334779
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\_ISMSIDEL.INI
            • Size 350B
            • SHA256 22245e8a67d33d166fcf51b3ad2ae7e22780c38a38ed65d1232d0020cfeeb0d7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\_ISMSIDEL.INI
            • Size 46B
            • SHA256 06d38311dc59cf5a078491d01fe65e579b3c5d72764bf93e35ae24cd74a805be
            • MD5 SHA1 SHA512
            Submit Download

            _ISMSIDEL.INI
            • Path C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\_ISMSIDEL.INI
            • Size 640B
            • SHA256 ef0cb24986e3fa4973d22c6c1892f11c580b4ba472cae814dfd69d10b6a41d9d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vcredist_x86.exe
            • Path C:\Users\Admin\AppData\Local\Temp\{E4844B05-CEC0-488B-9CD5-07E41BBA5D24}\{340B0957-35CA-1324-BBC9-BA5DB9082DAD}\vcredist_x86.exe
            • Size 6.2MB
            • SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll
            • Size 117KB
            • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI1773.tmp
            • Path C:\Windows\Installer\MSI1773.tmp
            • Size 97KB
            • SHA256 3a50e7aff840c6c5ed14052f35e1414aa2c20aae6f96dba315b0fae68de37d0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIAFE.tmp
            • Path C:\Windows\Installer\MSIAFE.tmp
            • Size 13KB
            • SHA256 fbd6bbf2cbe3f09b32844f856d9461605f0a008162c3a46da773b6454ba96f4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ARPPRODUCTICON.exe
            • Path C:\Windows\Installer\{B3305241-A2F4-4625-A3ED-45CF5E905A7A}\ARPPRODUCTICON.exe
            • Size 40KB
            • SHA256 b16de8874c6c37c8952efb424e87d20cd510524fcf0c9e5ffe3ac6da68b6dbbb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NewShortcut8_1.A02ED2FB_C587_4852_9041_F8BE9D9F3B36.exe
            • Path C:\Windows\Installer\{B3305241-A2F4-4625-A3ED-45CF5E905A7A}\NewShortcut8_1.A02ED2FB_C587_4852_9041_F8BE9D9F3B36.exe
            • Size 48KB
            • SHA256 1c9ec8e17d40d048551e47686bfeaa3513eb310e0259b2f9a2e4f8a437dd7cf9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3664-186-0x0000014049650000-0x0000014049FF4000-memory.dmp
            Download

            memory/3664-455-0x0000014049650000-0x0000014049FF4000-memory.dmp
            Download