f6440afa2e7866b2fc44fff37c044dd35c2c5f112911e07b98ffaadcaae8c3fb

Analysis

max time kernel
123s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31-10-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QuantAnalysis.msi
Size

10.8MB
MD5

eed73ffb6f45153f5262fb46c8ab7ddc
SHA1

cb77c2fa6ea50fe2e2f124e49701112ea0acd038
SHA256

f6440afa2e7866b2fc44fff37c044dd35c2c5f112911e07b98ffaadcaae8c3fb
SHA512

600e0890aa308cb49a74c70b1e2d76b2ed8524c352212d847041d89efcbc393e027b6566d2790f9c384c31cb21643f7cbb94960fa3b6cc012224b1057817950e
SSDEEP

49152:HFoRM63NLhkx5pHP9eSh9/MEGrQzdv1Pk+41+BcXsXOGXsXv5ooWT0HjW0Rz15yZ:He38Fx/zGcJ6+I+IeOsev5rW0l6

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	3052	msiexec.exe
4	3052	msiexec.exe
8	3052	msiexec.exe
9	3052	msiexec.exe
10	3052	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\Microsoft.Scripting.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\Microsoft.Dynamic.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI41D8.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fb86.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fb86.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\QuantCustomAction.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\Microsoft.Scripting.Metadata.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2A77.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\Agilent.MassHunter.ReportBuilder.Common.resources.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFCF7C8A2FAE161C75.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\Agilent.MassHunter.ReportBuilder.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\CustomActionUtils.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\IronPython.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFF7E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3CA55987A2FE23F9.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{03F52B60-CB5C-4700-9F35-4C1C1CA134A1}	msiexec.exe

Loads dropped DLL 18 IoCs

pid	Process
4120	MsiExec.exe
1464	MsiExec.exe
2184	rundll32.exe
2184	rundll32.exe
2184	rundll32.exe
2184	rundll32.exe
2184	rundll32.exe
1464	MsiExec.exe
1416	rundll32.exe
1416	rundll32.exe
1416	rundll32.exe
4120	MsiExec.exe
4120	MsiExec.exe
4672	MsiExec.exe
1948	rundll32.exe
1948	rundll32.exe
1948	rundll32.exe
1928	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3052	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d3755855d3e98e80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d3755850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d375585000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d375585000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d37558500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4584	msiexec.exe
4584	msiexec.exe
4584	msiexec.exe
4584	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3052	msiexec.exe
Token: SeSecurityPrivilege	4584	msiexec.exe
Token: SeCreateTokenPrivilege	3052	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3052	msiexec.exe
Token: SeLockMemoryPrivilege	3052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3052	msiexec.exe
Token: SeMachineAccountPrivilege	3052	msiexec.exe
Token: SeTcbPrivilege	3052	msiexec.exe
Token: SeSecurityPrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeLoadDriverPrivilege	3052	msiexec.exe
Token: SeSystemProfilePrivilege	3052	msiexec.exe
Token: SeSystemtimePrivilege	3052	msiexec.exe
Token: SeProfSingleProcessPrivilege	3052	msiexec.exe
Token: SeIncBasePriorityPrivilege	3052	msiexec.exe
Token: SeCreatePagefilePrivilege	3052	msiexec.exe
Token: SeCreatePermanentPrivilege	3052	msiexec.exe
Token: SeBackupPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeShutdownPrivilege	3052	msiexec.exe
Token: SeDebugPrivilege	3052	msiexec.exe
Token: SeAuditPrivilege	3052	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3052	msiexec.exe
Token: SeChangeNotifyPrivilege	3052	msiexec.exe
Token: SeRemoteShutdownPrivilege	3052	msiexec.exe
Token: SeUndockPrivilege	3052	msiexec.exe
Token: SeSyncAgentPrivilege	3052	msiexec.exe
Token: SeEnableDelegationPrivilege	3052	msiexec.exe
Token: SeManageVolumePrivilege	3052	msiexec.exe
Token: SeImpersonatePrivilege	3052	msiexec.exe
Token: SeCreateGlobalPrivilege	3052	msiexec.exe
Token: SeCreateTokenPrivilege	3052	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3052	msiexec.exe
Token: SeLockMemoryPrivilege	3052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3052	msiexec.exe
Token: SeMachineAccountPrivilege	3052	msiexec.exe
Token: SeTcbPrivilege	3052	msiexec.exe
Token: SeSecurityPrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeLoadDriverPrivilege	3052	msiexec.exe
Token: SeSystemProfilePrivilege	3052	msiexec.exe
Token: SeSystemtimePrivilege	3052	msiexec.exe
Token: SeProfSingleProcessPrivilege	3052	msiexec.exe
Token: SeIncBasePriorityPrivilege	3052	msiexec.exe
Token: SeCreatePagefilePrivilege	3052	msiexec.exe
Token: SeCreatePermanentPrivilege	3052	msiexec.exe
Token: SeBackupPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeShutdownPrivilege	3052	msiexec.exe
Token: SeDebugPrivilege	3052	msiexec.exe
Token: SeAuditPrivilege	3052	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3052	msiexec.exe
Token: SeChangeNotifyPrivilege	3052	msiexec.exe
Token: SeRemoteShutdownPrivilege	3052	msiexec.exe
Token: SeUndockPrivilege	3052	msiexec.exe
Token: SeSyncAgentPrivilege	3052	msiexec.exe
Token: SeEnableDelegationPrivilege	3052	msiexec.exe
Token: SeManageVolumePrivilege	3052	msiexec.exe
Token: SeImpersonatePrivilege	3052	msiexec.exe
Token: SeCreateGlobalPrivilege	3052	msiexec.exe
Token: SeCreateTokenPrivilege	3052	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3052	msiexec.exe
Token: SeLockMemoryPrivilege	3052	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4120	4584	msiexec.exe	80
PID 4584 wrote to memory of 4120	4584	msiexec.exe	80
PID 4584 wrote to memory of 4120	4584	msiexec.exe	80
PID 4584 wrote to memory of 1464	4584	msiexec.exe	81
PID 4584 wrote to memory of 1464	4584	msiexec.exe	81
PID 1464 wrote to memory of 2184	1464	MsiExec.exe	82
PID 1464 wrote to memory of 2184	1464	MsiExec.exe	82
PID 1464 wrote to memory of 1416	1464	MsiExec.exe	83
PID 1464 wrote to memory of 1416	1464	MsiExec.exe	83
PID 4584 wrote to memory of 2920	4584	msiexec.exe	87
PID 4584 wrote to memory of 2920	4584	msiexec.exe	87
PID 4584 wrote to memory of 4672	4584	msiexec.exe	89
PID 4584 wrote to memory of 4672	4584	msiexec.exe	89
PID 4672 wrote to memory of 1948	4672	MsiExec.exe	90
PID 4672 wrote to memory of 1948	4672	MsiExec.exe	90
PID 4584 wrote to memory of 1928	4584	msiexec.exe	91
PID 4584 wrote to memory of 1928	4584	msiexec.exe	91
PID 4584 wrote to memory of 1928	4584	msiexec.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\QuantAnalysis.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E729D2A57203D79EBF12F26470F1DFCE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4120
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 91EF3A7056CBBE022DAB674E5DBA4CE9 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI703F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240611515 3 QuantCustomAction!QuantCustomAction.CustomActions.DetectCustomerHome
    3⤵
    - Loads dropped DLL
    PID:2184
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7198.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240611750 16 QuantCustomAction!QuantCustomAction.CustomActions.DetectReportBuilderCommonFolder
    3⤵
    - Loads dropped DLL
    PID:1416
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2920
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CD70B88AD526707D2E9192FB480112A8
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFF7E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648218 2 QuantCustomAction!QuantCustomAction.CustomActions.TranslateSidToName
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:1948
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3CC00F69058265A26AB20ED8AD0FCE06
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3854FAC0D697873AEC36877F496668D2

Filesize
10KB

MD5
a5b207ecda7d98827e121a903fadf43d

SHA1
c933e93d2f14d3ed7bedce189646f5b9436bf39f

SHA256
89e2b61f14682c065070c6e7fb6ca254555336c8e4092321913eea8edb1de1e5

SHA512
b3fec39c8a404c739f119a2b8430788509a99ebb97b5c3e82e90cc3b66068c54f4299a143e387729debd19ed43d8529b6373ce04ea37bb91a86593cbaff0b791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\472BC96E644745821BD57EA65406C816

Filesize
1KB

MD5
b7b89696a30acab9b6b6b944d55514a7

SHA1
4d37505156c7c7288b4c4d569cec0087273ff718

SHA256
450d65c3e4a85fc4e7f39b972b71982042e1a1302dce6d9242aadd6fa90fbccb

SHA512
d34c1f79dcccc3147b568b2f2038c012a6b244cf6117aa59fcad65d3178de0b4abaed45f5cc4e3c9952ba4fbfdf2dcf63819b928d8c58d648da4b20596df78b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_FA129B8B6A20B1F61C992EE943B85715

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B

Filesize
388B

MD5
e12cdcdfcd98ff5504ce9bc791ce78cf

SHA1
4ceab8399616b201e851d701551c3e9a26a59b45

SHA256
87b6477a113fff71780bc24205a683eedffdc3d21f4826ebd0a88523b6203e89

SHA512
ba6ca134e58326b60a629a16a4e7a9d6d6c847d86e6401f692619e2ac82110580eaee06389811fa7ddad46560cffd1e0c1987595559b96b417e666096c6c54bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3854FAC0D697873AEC36877F496668D2

Filesize
170B

MD5
89ac934ae1bc4d619b67153992d78936

SHA1
a053dca9955ce7b47505f401b95cfc0ae3ee9fe4

SHA256
e44e87f041d84d6597c74f4c86be95e7b85d8df2432e80c8b6d896c48b57da22

SHA512
52fee69828c0df63b5bc63c952cd2ab198ffdff3bdae700c283f1f410ea14d6fd2087cd1630effed2d88c40ba3880935646f1d31821616ae8b7ca7d6e891e922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\472BC96E644745821BD57EA65406C816

Filesize
192B

MD5
576a9879bb3305a021226f574b2f8894

SHA1
77a6e65f1bd17a8a37c5078b13dcb4baecc614da

SHA256
5ab03d789c16d2a4a7b8de73e3d375da873f624a1d9b73393e645863c210baea

SHA512
c84cdb907df90d5778524b13a8a8fc99884862d0db5e93cb404888584ee08fb7938dbc463ee782b27f08d720cec03a8cd222d35985e13eafacb5a3f26863ca17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_FA129B8B6A20B1F61C992EE943B85715

Filesize
390B

MD5
93911394e4560554557556336cb0c528

SHA1
2047ae7e8db60f6ceca9110c1c89ac7846953fb8

SHA256
309fc7a7074890363f79ac0610262c6c57237fcb782e8c5c281ddf969d60e56a

SHA512
91d8a3193cb945ca4033a891bb005028b81e35ea81ec1bb1ea72b7662caf7d78d7de4baee4e2162d9dcee1db741de43a30e89725da80ad0da453139b3b4b1e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
79dd9d574bf7da4d10dee390db653a12

SHA1
ddb3e64a2e79b01101cbd6d553eda0659451bc84

SHA256
4c0cac895c138615c44f674f0a92304ec664e87fbd3721eb9f403cc03f2fea34

SHA512
f08b39971a8cc77761dea295906bead275aac4011821a3ea1c0a78ae1162bbbb1cf51cc93fbbb7c72cc4ac1bd2cb7d69cdd27ef6ff93d31ef66be8f97615e4b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6CF2.tmp

Filesize
199KB

MD5
3a4e61909500d677745ef2ab508f3f3b

SHA1
ee398e1a153ca96c2592816eb8e8b2b7bb845e1e

SHA256
fb7a6eb19d1d1042d3bd8b3add9271116b8b6db3714dfcc0b6fee8e088d4a2cc

SHA512
feba07bba5007a20e0a1e2ca8c9050ae8624e8fbb0f24aada5dc7c2bde3be561b844453a573cab2a24c3769a8dba401db4eeef0d22ef86e2109b67e54392ee45

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI703F.tmp

Filesize
1.3MB

MD5
3704a1c7537679f424a175e41a358831

SHA1
88e94d11cc778048ccaf311c85ddaf4079d92d05

SHA256
2d544865ce9377960393ad0399d2f8193e8f2388af35af2f3a4a83f663fe6c1d

SHA512
3696733f49d95cf2395c464f3c9bbb978220ec790a95b8687f589076cb1004b8e53db8115eb21164c061ce621516fd78368638bb710356ed03e1284c60d51e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI703F.tmp-\CustomActionUtils.dll

Filesize
5KB

MD5
26452ceae72e1a7eb954919cad85261d

SHA1
3e0ce558624156818ad9763067903632393e1545

SHA256
88558723dddf63ef8b72c1ff7ed0892895839aa1e736edbd23d690acaff5188c

SHA512
56ff796524f2f0f453e5b1fa1a855dccf4465469a6b9945019ac397f3c01676cbfdf2a7ebf31382c5a04227402104bddc6df1d8fb80bd79eeedd1d0eadb6f94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI703F.tmp-\QuantCustomAction.dll

Filesize
13KB

MD5
4e27768f2c0de3564599ac585f59bc3c

SHA1
905c0eea30a704447a748f2a1d2bc31a2e70958c

SHA256
00a586dacb6092ba0d60e468a7ec1f86f7b3d1fc90967a0d7a7ec0ce0b866264

SHA512
0cbfb297c3393e4d7f2cc29e7882f8a628eb499f7bc76a27a2daaaaed806c75625a51167d349570fab044c26510fa2187836210e63d432b66ab96c49a66fed48

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7198.tmp-\CustomAction.config

Filesize
1KB

MD5
4933c1e1be5973187e991ea2ed9e6451

SHA1
b16b52ba34a835b5bb8665f502e7e37985b6776e

SHA256
dc44fb3a0ce9cb88926b2d91ec3cc5a5c5d694b02415c4b2459090f08f08ed58

SHA512
766ed216354a9d0f681607577e586e89dc82729ced58c328676771178ba547cd87878a1f5955cd46b197672753bc693d08246a7a11ceb8a7f255e1321403e805

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7198.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
73527c4ccfe8c3d2f27ffb4b9d1adff2

SHA1
29f5a5a2c3f2d59753442317e51ff2a6a74a3bbd

SHA256
2dd1998a04bf8ab20dabd3da8d8cb9f4be737700ae100260f6f378d667a1a714

SHA512
1df26232f30e9cb11fbbaaeee049053077425ad6b7d691ca759553c0e0cbbbc1fa8fb07fab2bf8ad63b4ea75e70988f29d9fb42994961301a59f690f3b10b8d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI94A2.tmp

Filesize
102KB

MD5
d9ac1b56edf330a6eb7894ab293f14f6

SHA1
022d8944e3927fff2b330dab54716ddcbb366d16

SHA256
097f1c3f27b18010448d77e3f70c4d9f774cb9c5ab435c62baa1c00e4cadd5ef

SHA512
e434410e2b2c2bb1fba4f3fc7c277b978c45b1df1d3c3994d6dc1530558393d7d42a713506bf95d013b2e40e9da36fd3e588fea8d8dc062a24ad931e4d76c328

Download Submit
C:\Windows\Installer\MSI41D8.tmp

Filesize
125KB

MD5
1c302a070ebbd4f4bd53a80d55af6b16

SHA1
8eaf3ebc9b0fbc6cb0b581a1dc15926686003125

SHA256
26d11fcfceca93490c3b2d624ecdbc7a169c87fbee5c4da347e99696368a08ba

SHA512
6b1d96d55d22d1137882e504601f1e907ccc44b903cd7188c9c9b93f3ea18cf7f5029641be09805811c8effa679efcd339a16695089ad31c1e54b60799741e09

Download Submit
C:\Windows\Installer\MSIFF7E.tmp-\Agilent.MassHunter.ReportBuilder.Common.dll

Filesize
92KB

MD5
b28c68187ad1690a0098cdac086a5bcd

SHA1
faab81f060e837b38de23485562f75082543c960

SHA256
8f0241a8511301ab18825fefa7316cbf07a26c3ac97e8c327685613a57aede7d

SHA512
b5c89bea0306f915ba9d8314c64096738bed64e692c4288f512fc54d22c34c8e8c52c3b47ce43aacb003ed65a5e6d39a2d12a6afa5b73ca87218ace9832d3381

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
b9b2f2fb34bbe33df7ac4e0384bf8258

SHA1
fec40480c013d8d6fc2bee99e713942d2a882a33

SHA256
ca5336f9a535f34ffb117d1cfdb759cc818fb8c4c60b1e30fc91e213f080547f

SHA512
4f46cd6b6d7f70cfb90d476536a0dc0dc3c64c79f82603fc148c1d0a16d567b76125a62163404f7fdc2619fabedf81dd3faaad8d2b78e8080c5a683acd2c4e97

Download Submit
\??\Volume{8555371d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4fc65e37-6f80-450c-bd97-ab1e2c911812}_OnDiskSnapshotProp

Filesize
6KB

MD5
dd6f3b4470e6eda0b7bf3a7919b9c54e

SHA1
eb8f130b6e03c8758313b18d6b0fc97d4a39ca20

SHA256
28cceaffc53b33899a173bdb576d22fcfeac7dd450eccbd5c2a2741701fff07b

SHA512
87e9c7bb1199369919f6b8ed66ae9a9810627013fbd7db472ec746626b5599e578894d1d098636cc9b50cb1fadd6c78c7137d269f7ade2d53ffa5644125f1d88

Download Submit
memory/1416-90-0x00000133D8C30000-0x00000133D8C4E000-memory.dmp

Filesize
120KB

Download
memory/2184-50-0x000001D7DAD40000-0x000001D7DAD46000-memory.dmp

Filesize
24KB

Download
memory/2184-46-0x000001D7DAD30000-0x000001D7DAD38000-memory.dmp

Filesize
32KB

Download
memory/2184-42-0x000001D7DAD60000-0x000001D7DAD8E000-memory.dmp

Filesize
184KB

Download