0f267f0c8023f38bd8d0c47eae8539495f5523a569d64081816469a5d01321ef

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WjXSI4.msi
Size 22.4MB
Sample260723-g6vpeshc98
SHA256 0f267f0c8023f38bd8d0c47eae8539495f5523a569d64081816469a5d01321ef
MD5 278f37c53eefdf281f5cbd5877552b69
SHA1 6e0582a845453a85ef4a9c94fdcbe3b5203d0f0f
SHA512 74a1ecb70d54906bedb804bad073f75bf4d8d5196deb44bef47502ffbbab1fd5ecbb86287f86b35db4806e80ed34df1b0fa663a947ea05d55727ab80b724e61d
SSDEEP 393216:6Tw9/ZB/y6YZKEDbRcdfaH+tpEabPs0c2ZY2XEcQJwMKqdiVbAYy4ZTBfXcr95N:6TUBB6NZKGbKaHwGabQr9KWGO4ZCZJAx
TLSH
T17A37339B3EC48A62C00F1E7151728BF9A3757D1057961913922C38AFD1F6BE0ADB2CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	Quantframe.exe

Loads dropped DLL 1 IoCs

pid	Process
5176	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Quantframe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Quantframe\resources\sounds\cat_meow.mp3	msiexec.exe
File created	C:\Program Files\Quantframe\resources\sounds\iphone_notification.mp3	msiexec.exe
File created	C:\Program Files\Quantframe\resources\sounds\windows_xp_startup.mp3	msiexec.exe
File created	C:\Program Files\Quantframe\resources\tos.md	msiexec.exe
File created	C:\Program Files\Quantframe\Uninstall Quantframe.lnk	msiexec.exe
File created	C:\Program Files\Quantframe\Quantframe.exe	msiexec.exe
File created	C:\Program Files\Quantframe\qf_app_lib.dll	msiexec.exe
File created	C:\Program Files\Quantframe\resources\sounds\windows_xp_error.mp3	msiexec.exe
File created	C:\Program Files\Quantframe\resources\sounds\windows_notification.mp3	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a16a6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EA7BAB55-CEFE-4ECC-AEA8-DE7EE68A2B2F}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_133053830\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF264AF3ECEDA04DAD.TMP	msiexec.exe
File created	C:\Windows\Installer\{EA7BAB55-CEFE-4ECC-AEA8-DE7EE68A2B2F}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9A2DE2A8A08FAD0A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_133053830\keys.json	msedgewebview2.exe
File created	C:\Windows\Installer\e5a16a6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0B7C892F56AFC26B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EA7BAB55-CEFE-4ECC-AEA8-DE7EE68A2B2F}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_133053830\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e5a16a8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB4DE1D54B56D324E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_133053830\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_133053830\_metadata\verified_contents.json	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5964	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\ProductIcon = "C:\\Windows\\Installer\\{EA7BAB55-CEFE-4ECC-AEA8-DE7EE68A2B2F}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5B12AAAF2A2F1515785D4D9DA8469430	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\PackageCode = "39ABF37E7D47B00458A551D96A0D7D4A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5B12AAAF2A2F1515785D4D9DA8469430\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\SourceList\PackageName = "WjXSI4.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\Version = "17170457"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55BAB7AEEFECCCE4EA8AEDE76EA8B2F2\ProductName = "Quantframe"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5720	msiexec.exe
5720	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2200	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5964	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5964	msiexec.exe
Token: SeSecurityPrivilege	5720	msiexec.exe
Token: SeCreateTokenPrivilege	5964	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5964	msiexec.exe
Token: SeLockMemoryPrivilege	5964	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5964	msiexec.exe
Token: SeMachineAccountPrivilege	5964	msiexec.exe
Token: SeTcbPrivilege	5964	msiexec.exe
Token: SeSecurityPrivilege	5964	msiexec.exe
Token: SeTakeOwnershipPrivilege	5964	msiexec.exe
Token: SeLoadDriverPrivilege	5964	msiexec.exe
Token: SeSystemProfilePrivilege	5964	msiexec.exe
Token: SeSystemtimePrivilege	5964	msiexec.exe
Token: SeProfSingleProcessPrivilege	5964	msiexec.exe
Token: SeIncBasePriorityPrivilege	5964	msiexec.exe
Token: SeCreatePagefilePrivilege	5964	msiexec.exe
Token: SeCreatePermanentPrivilege	5964	msiexec.exe
Token: SeBackupPrivilege	5964	msiexec.exe
Token: SeRestorePrivilege	5964	msiexec.exe
Token: SeShutdownPrivilege	5964	msiexec.exe
Token: SeDebugPrivilege	5964	msiexec.exe
Token: SeAuditPrivilege	5964	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5964	msiexec.exe
Token: SeChangeNotifyPrivilege	5964	msiexec.exe
Token: SeRemoteShutdownPrivilege	5964	msiexec.exe
Token: SeUndockPrivilege	5964	msiexec.exe
Token: SeSyncAgentPrivilege	5964	msiexec.exe
Token: SeEnableDelegationPrivilege	5964	msiexec.exe
Token: SeManageVolumePrivilege	5964	msiexec.exe
Token: SeImpersonatePrivilege	5964	msiexec.exe
Token: SeCreateGlobalPrivilege	5964	msiexec.exe
Token: SeCreateTokenPrivilege	5964	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5964	msiexec.exe
Token: SeLockMemoryPrivilege	5964	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5964	msiexec.exe
Token: SeMachineAccountPrivilege	5964	msiexec.exe
Token: SeTcbPrivilege	5964	msiexec.exe
Token: SeSecurityPrivilege	5964	msiexec.exe
Token: SeTakeOwnershipPrivilege	5964	msiexec.exe
Token: SeLoadDriverPrivilege	5964	msiexec.exe
Token: SeSystemProfilePrivilege	5964	msiexec.exe
Token: SeSystemtimePrivilege	5964	msiexec.exe
Token: SeProfSingleProcessPrivilege	5964	msiexec.exe
Token: SeIncBasePriorityPrivilege	5964	msiexec.exe
Token: SeCreatePagefilePrivilege	5964	msiexec.exe
Token: SeCreatePermanentPrivilege	5964	msiexec.exe
Token: SeBackupPrivilege	5964	msiexec.exe
Token: SeRestorePrivilege	5964	msiexec.exe
Token: SeShutdownPrivilege	5964	msiexec.exe
Token: SeDebugPrivilege	5964	msiexec.exe
Token: SeAuditPrivilege	5964	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5964	msiexec.exe
Token: SeChangeNotifyPrivilege	5964	msiexec.exe
Token: SeRemoteShutdownPrivilege	5964	msiexec.exe
Token: SeUndockPrivilege	5964	msiexec.exe
Token: SeSyncAgentPrivilege	5964	msiexec.exe
Token: SeEnableDelegationPrivilege	5964	msiexec.exe
Token: SeManageVolumePrivilege	5964	msiexec.exe
Token: SeImpersonatePrivilege	5964	msiexec.exe
Token: SeCreateGlobalPrivilege	5964	msiexec.exe
Token: SeCreateTokenPrivilege	5964	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5964	msiexec.exe
Token: SeLockMemoryPrivilege	5964	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5964	msiexec.exe
5964	msiexec.exe
2340	Quantframe.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5964	msiexec.exe
5720	msiexec.exe
5176	MsiExec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 5176	5720	msiexec.exe	90
PID 5720 wrote to memory of 4920	5720	msiexec.exe	97
PID 5964 wrote to memory of 2340	5964	msiexec.exe	100
PID 2340 wrote to memory of 2200	2340	Quantframe.exe	102
PID 2200 wrote to memory of 4452	2200	msedgewebview2.exe	103
PID 2200 wrote to memory of 2868	2200	msedgewebview2.exe	104
PID 2200 wrote to memory of 2868	2200	msedgewebview2.exe	104
PID 2200 wrote to memory of 2868	2200	msedgewebview2.exe	104
PID 2200 wrote to memory of 2868	2200	msedgewebview2.exe	104
PID 2200 wrote to memory of 4072	2200	msedgewebview2.exe	105
PID 2200 wrote to memory of 3340	2200	msedgewebview2.exe	106
PID 2200 wrote to memory of 3340	2200	msedgewebview2.exe	106
PID 2200 wrote to memory of 3340	2200	msedgewebview2.exe	106
PID 2200 wrote to memory of 6132	2200	msedgewebview2.exe	107
PID 2200 wrote to memory of 6132	2200	msedgewebview2.exe	107
PID 2200 wrote to memory of 6132	2200	msedgewebview2.exe	107
PID 2200 wrote to memory of 6132	2200	msedgewebview2.exe	107
PID 2200 wrote to memory of 6132	2200	msedgewebview2.exe	107
PID 2200 wrote to memory of 4156	2200	msedgewebview2.exe	110
PID 2200 wrote to memory of 4156	2200	msedgewebview2.exe	110
PID 2200 wrote to memory of 4156	2200	msedgewebview2.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WjXSI4.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Program Files\Quantframe\Quantframe.exe
  "C:\Program Files\Quantframe\Quantframe.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Quantframe.exe --webview-exe-version=1.6.25 --user-data-dir="C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2340.5760.9648639239601263799 /pfhostedapp:f10b84dcd0b3e3a9487ed7258a83c8904eaad32e
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView /prefetch:4 /pfhostedapp:f10b84dcd0b3e3a9487ed7258a83c8904eaad32e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x9c,0x7ffb90245fd8,0x7ffb90245fe4,0x7ffb90245ff0
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView" --webview-exe-name=Quantframe.exe --webview-exe-version=1.6.25 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1792,i,7736175452129761404,11326075996340298063,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f10b84dcd0b3e3a9487ed7258a83c8904eaad32e
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView" --webview-exe-name=Quantframe.exe --webview-exe-version=1.6.25 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1792,i,7736175452129761404,11326075996340298063,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f10b84dcd0b3e3a9487ed7258a83c8904eaad32e
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView" --webview-exe-name=Quantframe.exe --webview-exe-version=1.6.25 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1792,i,7736175452129761404,11326075996340298063,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f10b84dcd0b3e3a9487ed7258a83c8904eaad32e
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView" --webview-exe-name=Quantframe.exe --webview-exe-version=1.6.25 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3332 --field-trial-handle=1792,i,7736175452129761404,11326075996340298063,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f10b84dcd0b3e3a9487ed7258a83c8904eaad32e /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView" --webview-exe-name=Quantframe.exe --webview-exe-version=1.6.25 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4408 --field-trial-handle=1792,i,7736175452129761404,11326075996340298063,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f10b84dcd0b3e3a9487ed7258a83c8904eaad32e
      4⤵
      PID:4156

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 62A45025F7556D830E1349F09245E76D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5176
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:344

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a16a7.rbs

Path C:\Config.Msi\e5a16a7.rbs
Size 13KB
SHA256 f0a38e73b65c247b75ce827763acee37c6854a8e8387a9030cf6bdee005fa987
MD5 bde7e5dc6c086ce89f196e29814740bc
SHA1 165f864754099ed6465a3a454b1bad377bf2727c
SHA512 a570e55168b626d6d5afae9b2003f585468e9349e12c02d8bf8e48f66fb3240f7276ca790884b4a6647c1a45222ac3e8539a8d5bf0c9afbf13796e16c79399c8
SSDEEP 192:cbQ9HjzbvEf6zbjtjtjtjtIC4caPG6aPeJycsUDWCifqpD:cbQ9HjzbvEf6zbjtjtjtjtra9aWmU
TLSH
T1695230426A00C3D3E5EF5738DB1B13613B73C1A953AC439B4ACD51245E937C22BA9A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tos.md

Path C:\Program Files\Quantframe\resources\tos.md
Size 1KB
SHA256 391ff782ce760fadfe4d6e19a5e28819ba1d89972ca1f44275f9c184f0e606e4
MD5 69a569520ac57cae0991f86078053a8b
SHA1 eb01f61e86aa9713621d40d7f8d7b5afc0793600
SHA512 31596b197e7b7a829870f582a08dc27f8a341a0b8b0713d9a48128af612fbc34f26edc223280e5fb578e8b646cad1402dc4885ac11adb957c060711727483dbb
TLSH
T1A63164438647D77820772282882BD7F4FB2C50A5233ED6543CA081497796E6E8B37A9C
MD5 SHA1 SHA512 TLSH

Submit Download

Quantframe.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quantframe\Quantframe.lnk
Size 2KB
SHA256 e00ccba5d585d88d67e6c2afe0efae4173e25559876af88eee5d81bfe1890f53
MD5 79698a2f2591e28ff7b708e96e18fcff
SHA1 26d7225b7224c35a9588a5eb05021c5b630c8002
SHA512 9c628934d08ece74bb2b1449782af5a829f2359dd41061648e4dfa066d5f3a73b60d84415cf1bd37c8c0b1b60f67472cd7a1bd6fac6778f2c7989ff776ce887d
TLSH
T181418E085BEB137DF3B343B11E7886629777FC11E62A8F6F41D9108458B461095A9F3E
MD5 SHA1 SHA512 TLSH

Submit Download

Quantframe.lnk~RFe5a2442.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quantframe\Quantframe.lnk~RFe5a2442.TMP
Size 1KB
SHA256 027e16d7c0fb91be1af2ce19883d6852d995a3765863f5168b0a8e5b004b5d78
MD5 a56f4707f39d89f835e15657a4d226a2
SHA1 c3bc1b542ee2fa7a0c4f4c951285e1bff7d9ec4f
SHA512 05d6c554667821a12636b73aba27eedb05b175d536d1a8b3839a37f5b381073a16676171c15f09ff8eb09dd4c0f09fa500736df62cb333a8f8d290a8eda80408
TLSH
T1C041C0085BFB137DF3B343B11E7886629777FC01E62A8F6B41D51084487061095A5F3E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8543.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8543.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8f222adc07291341eb572a5293df8f7358dadeec1c461710d36e218cda2fd935
MD5 2b41556571d5e09eed772ef85e723c7b
SHA1 e3d68fbdc45f55d31a8827e00790b2c339103030
SHA512 38c15aa1bb93a4af499a4e8c819da42bbfbd749ca4302272e1791162f1e5ce09537f5f4abebbe5efcd5a979bff9c59a937321d408888f775c5dc3c140fbac547
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f357568c7fd82f16d727c360382ae56c50ef420523288ec2c3f9082782b40c70
MD5 de034bf1102d370ee32820e3fd70ca82
SHA1 4153da727580ed741b2201fd186dfbecc617d683
SHA512 9adddd9bc352736b7672bbb64fbe859f5ebe523a8393a11ca4fde810447c487b90864e1c546c485a154ac7d50e0b2396066c67a12597a82e44dd0fbae9ead327
TLSH
T144D0121233410538C01030B3100266480501C20F410942446539B52E2B080501E13441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

7aa99068-7213-47b6-be98-e8f095b5c6a1.tmp

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\7aa99068-7213-47b6-be98-e8f095b5c6a1.tmp
Size 6KB
SHA256 e17ef4789103fd78d709d5f65befd17dcd2820909a5058783247d29f75954ccd
MD5 d4f7258682ecce7ddf5e5d1b3d18f9f3
SHA1 9332d8ef8f99bed74b600b133d53d7fa6476673b
SHA512 f209cba8f706754c9e065d784f9c64b753b046fc92d9aebfd91ee53fbca14219dcc1949710816f6241a24a413808f0fdd1cacf8a9614cfc0fa01677136427f6b
SSDEEP 96:stU4/djjKEmk3zGb9GkKyo5h16ZPUis7/x+6MhmuecpUvr1eje7LWK+gxBqm28XE:stlxvio+XsV+FNsrQjERRG6K
TLSH
T1E6D1B606AE2479BB4CC6F119BA29BB07E2F5503275D11E98E7F8461C08DA5DD2307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 3c59f870676984cfe68426b9d96c445eb0ff9a54f219f85c4fdead6e8ab660be
MD5 4f0bc68f266cb2e43c1be67acc372e9d
SHA1 b255faa158908fc8cdfcb9a1292260bcd6e57cb3
SHA512 06ffdac568f17b78502525e38ed555f656715870ac390362175a7a0c88712af36905cd18f6bac9d51539603b3d884a3e7bdab6796d83383903b4806191cbd50d
TLSH
T16A01E55487E654F6D30B56BC27D0F446F135157D658B0CA43375D8705A7D300C7715E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 e3d6421d849a57d95f6b32bf1401567f7987324dbed36de37c4094853c6ffb81
MD5 c185aee027e766b5a4ee0aff3545aaae
SHA1 89821686544a726bb15a41758584c71eb949b6eb
SHA512 a5fcc377b7cb4af383a1bad4283436ffa5cb956ad7546c5ab3e4f0ea4fe75a4f42c1701a16305e70d89485f66548977fda96689e1526a88aef5d4341384a0dd5
TLSH
T1140127644BD654FAC30A9ABC23D0F181F13555BD58870C643370C8311D7D30083716E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9c41.TMP

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a9c41.TMP
Size 48B
SHA256 a6e4cb522954d8756d9c12782741c875faadabbf857291382f13393876af8c71
MD5 ffedf95c99d92c58037fe6b7159cac82
SHA1 0d16c8905640f448f095d9e3ef7d82ff2313ce51
SHA512 650fb127f135d27ea252164967e09005f410ea4ba7e370a5886843875df3e0dd337c862307a3f620f9b7592f61340a158d93d24d1225b900bbdb4d867eac11b3
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b6eb4.TMP

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\Network\Network Persistent State~RFe5b6eb4.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

dd96e74f-5b92-4f77-ba16-08c0d38aa7c4.tmp

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\Network\dd96e74f-5b92-4f77-ba16-08c0d38aa7c4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Local State
Size 16KB
SHA256 87cf9d041a5d675f91f026cf7c2ebd8ba98be3ca049b0ba37da07b79d56dc211
MD5 0e62c73d1fea941ee85f2109f73a6a77
SHA1 778619425318956f93fcbcd605479a7df0fd628a
SHA512 9c861c9c0b5905787425af56026ff6f1500d2c3af05207b2664b8ec5fea7befa93e6484fa100a24274f74701398d21a39dace53df2dcd90a13963b249b95cb99
SSDEEP 384:i+aQikB+z/xvxjg/qhEwNBSk7DqNisdmY9zC:N/UxvxjgC+SmNisIYFC
TLSH
T14C729E3F94383E2795F7E9057D49079BDBB884B395827EB88AED5F0806C32D81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Local State
Size 2KB
SHA256 93c32da06bcd94f8278cc2fd7c9d661adc05511d478803c66c473f292c482bf6
MD5 2eed941c35f79707ebf1e889de6d5f6c
SHA1 ca2a1e686f31920abcd6b00b9de757671665bdaf
SHA512 c2ee6f293e89787b68c84fd772e5d5086119b24fdaa1a6f980ce61ecd03e30b5b0f843ed71c4acb36e4eff6bd8bb4c807e0dc0cb031204b3dc013c27639aed30
TLSH
T110518277A9106B7B98F396197D4A2E23DE7550A7EE622F90AACC0B0C00C754C2307C76
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Local State
Size 3KB
SHA256 42a7a5005d4bf9994c152c106427ebbba5496bab659dda4ed88cc58df6e70573
MD5 55f7f4f93234e1347415d4776e451d53
SHA1 92a21a6af92ef1bb2122481c4a6c3f2396f0d29f
SHA512 cd85f73d4295f34b295c48300071f5ac2c364248508530aff179944a229d87f66fd7dd39816b19846aacc323e97eb2d0ecfd9c58e6ad0fa6bb61c6262d4a060d
TLSH
T13671937B9960AA7B4DF39A057C862B17ABA15077EA953FE4D9EC0F0C01C72881302C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a48f1.TMP

Path C:\Users\Admin\AppData\Local\dev.kenya.quantframe\EBWebView\Local State~RFe5a48f1.TMP
Size 1KB
SHA256 39deff1837f3984de36400a5ed731b051803fb0fcf34aed73e27b2f560702f8c
MD5 6fe8b4c4e9b41b1ba4e71e6d6a535d3b
SHA1 eae0803e7823564f17f1627b21ba9cd799e00fdb
SHA512 7be57991eb1ff46801e65fb67e6b1fcf001fc011277f4a9beb5d1320f93034fdf67ceb0402b84155f9452cef730f9677969e271c61e0bafd72ea465388ea7e8a
TLSH
T1CC3174B7C5602B72ACD7654A2545AEA76F3110BFDA524F84B5CC870C11D304C972FC32
MD5 SHA1 SHA512 TLSH

Submit Download

e5a16a6.msi

Path C:\Windows\Installer\e5a16a6.msi
Size 22.4MB
SHA256 0f267f0c8023f38bd8d0c47eae8539495f5523a569d64081816469a5d01321ef
MD5 278f37c53eefdf281f5cbd5877552b69
SHA1 6e0582a845453a85ef4a9c94fdcbe3b5203d0f0f
SHA512 74a1ecb70d54906bedb804bad073f75bf4d8d5196deb44bef47502ffbbab1fd5ecbb86287f86b35db4806e80ed34df1b0fa663a947ea05d55727ab80b724e61d
SSDEEP 393216:6Tw9/ZB/y6YZKEDbRcdfaH+tpEabPs0c2ZY2XEcQJwMKqdiVbAYy4ZTBfXcr95N:6TUBB6NZKGbKaHwGabQr9KWGO4ZCZJAx
TLSH
T17A37339B3EC48A62C00F1E7151728BF9A3757D1057961913922C38AFD1F6BE0ADB2CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b10a1ef7e83e8b8bd91505ace003a84425d31193398df5a5b54c597827413cb1
MD5 dd93892a121f8980fbd37671b7f79989
SHA1 30a7d36131f94400f23ed5f8a973e65e01686219
SHA512 9af61b3684febae1c1bb38e19454e8087d8981a7204526708a9ea96359135e1833bf4b7c591e3ce2f88e0ea6ab63c92f9b9c33a56b746548c6e8e328ca85eca7
SSDEEP 24576:5Fo3DMPbdoO/vvTL/CwF1yFQPrOfebSmUYjHdIrtDQrKJykVM4RWVsfUReh:XHU
TLSH
T1C457162436F92110E7F39E3DA8F46A234D397D579C16DE8C05425B8D0922FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f510e8c7-3fbe-4f7e-9ae3-9620729ea0bb}_OnDiskSnapshotProp

Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f510e8c7-3fbe-4f7e-9ae3-9620729ea0bb}_OnDiskSnapshotProp
Size 6KB
SHA256 9583fde3930054ede70c8dfe0f3e934ac32296592d39d5924a0381c6c32bfea3
MD5 7cbc2d698dd02d9c3e8d2e02cc45fc9a
SHA1 f6fd6e522ca1a6289f2e13d277040a0c4ac5943d
SHA512 79392c1ea95d8895054d42079b0923f783181d6738b6a1c24adcf15b7f5682c5fbfd5d8bd25dd29b1ad53fed72cf77bec6d805d870951a3439c80b4d1ab9b222
SSDEEP 96:FY3hBvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:mrb++uVm
TLSH
T12FD19A185AF54711E2B3AB3228F14557A477B911EF33CB8E0198638E2671910F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2868-372-0x0000019D423E0000-0x0000019D424F6000-memory.dmp

Download

memory/2868-363-0x0000019D423E0000-0x0000019D424F6000-memory.dmp

Download

memory/2868-77-0x00007FFBB3FE0000-0x00007FFBB3FE1000-memory.dmp

Download

memory/2868-329-0x0000019D423E0000-0x0000019D424F6000-memory.dmp

Download

memory/4156-403-0x00007FFBB3170000-0x00007FFBB3171000-memory.dmp

Download

memory/4156-402-0x00007FFBB37A0000-0x00007FFBB37A1000-memory.dmp

Download

memory/5720-50-0x0000017128E10000-0x00000171297B4000-memory.dmp

Download

memory/6132-330-0x000002275AD30000-0x000002275AE46000-memory.dmp

Download

memory/6132-104-0x00007FFBB3FE0000-0x00007FFBB3FE1000-memory.dmp

Download