e474a4311fde20abe83dd050aa6af17f096a5f08fb8dbb5aa9ec7e07490fc6dd

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quant Drive/QuantDrive.exe
Size 6.2MB
Sample260816-sdlrla1vax
SHA256 e474a4311fde20abe83dd050aa6af17f096a5f08fb8dbb5aa9ec7e07490fc6dd
MD5 2dd7815241d99db5604ba2ae038af145
SHA1 c53f246d23e2fd77b242e352841d8d49de93cb4e
SHA512 06d36039b911737c739299665e1057c2a6d1981c69062a3ceed1f1730c81306a7d5de9cb06c68683b71dac7d49b84a38130d62ce7a6d2ce4fce6ec495fd63638
SSDEEP 49152:REBmU4cjCcXqPv1L9YzdzN09V1Hh641wMMipY+qKA9M3wd/t5XbnABwKeK9KyOJe:RG8IG/hwriW+tbL5OXE
TLSH
T14C665B03ECA115E9C1EAE63189729252BA717C496B3123D73B98F7382F77BD06A75700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5644	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313660614652939"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{E19881EE-CFF4-4834-87B8-ED2FDF62AD8A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2392	4896	QuantDrive.exe	88
PID 2392 wrote to memory of 2664	2392	msedge.exe	89
PID 2392 wrote to memory of 4636	2392	msedge.exe	90
PID 2392 wrote to memory of 5644	2392	msedge.exe	91
PID 2392 wrote to memory of 4636	2392	msedge.exe	90
PID 2392 wrote to memory of 4636	2392	msedge.exe	90
PID 2392 wrote to memory of 3264	2392	msedge.exe	92
PID 2392 wrote to memory of 3264	2392	msedge.exe	92
PID 2392 wrote to memory of 4300	2392	msedge.exe	93
PID 2392 wrote to memory of 4300	2392	msedge.exe	93
PID 2392 wrote to memory of 4300	2392	msedge.exe	93
PID 2392 wrote to memory of 2892	2392	msedge.exe	94
PID 2392 wrote to memory of 2892	2392	msedge.exe	94
PID 2392 wrote to memory of 2892	2392	msedge.exe	94
PID 2392 wrote to memory of 1504	2392	msedge.exe	95
PID 2392 wrote to memory of 1144	2392	msedge.exe	96
PID 2392 wrote to memory of 3016	2392	msedge.exe	97
PID 2392 wrote to memory of 4628	2392	msedge.exe	98
PID 2392 wrote to memory of 1504	2392	msedge.exe	95
PID 2392 wrote to memory of 1504	2392	msedge.exe	95
PID 2392 wrote to memory of 1144	2392	msedge.exe	96
PID 2392 wrote to memory of 1144	2392	msedge.exe	96
PID 2392 wrote to memory of 3016	2392	msedge.exe	97
PID 2392 wrote to memory of 3016	2392	msedge.exe	97
PID 2392 wrote to memory of 4628	2392	msedge.exe	98
PID 2392 wrote to memory of 4628	2392	msedge.exe	98
PID 2392 wrote to memory of 5036	2392	msedge.exe	103
PID 2392 wrote to memory of 2016	2392	msedge.exe	102
PID 2392 wrote to memory of 1796	2392	msedge.exe	99
PID 2392 wrote to memory of 556	2392	msedge.exe	101
PID 2392 wrote to memory of 4324	2392	msedge.exe	100
PID 2392 wrote to memory of 5036	2392	msedge.exe	103
PID 2392 wrote to memory of 5036	2392	msedge.exe	103
PID 2392 wrote to memory of 2016	2392	msedge.exe	102
PID 2392 wrote to memory of 2016	2392	msedge.exe	102
PID 2392 wrote to memory of 1796	2392	msedge.exe	99
PID 2392 wrote to memory of 1796	2392	msedge.exe	99
PID 2392 wrote to memory of 556	2392	msedge.exe	101
PID 2392 wrote to memory of 468	2392	msedge.exe	104
PID 2392 wrote to memory of 556	2392	msedge.exe	101
PID 2392 wrote to memory of 4324	2392	msedge.exe	100
PID 2392 wrote to memory of 4324	2392	msedge.exe	100
PID 2392 wrote to memory of 468	2392	msedge.exe	104
PID 2392 wrote to memory of 468	2392	msedge.exe	104
PID 2392 wrote to memory of 1988	2392	msedge.exe	105
PID 2392 wrote to memory of 5668	2392	msedge.exe	106
PID 2392 wrote to memory of 1988	2392	msedge.exe	105
PID 2392 wrote to memory of 5668	2392	msedge.exe	106
PID 2392 wrote to memory of 5656	2392	msedge.exe	108
PID 2392 wrote to memory of 1652	2392	msedge.exe	109
PID 2392 wrote to memory of 2644	2392	msedge.exe	110
PID 2392 wrote to memory of 2760	2392	msedge.exe	111
PID 2392 wrote to memory of 5896	2392	msedge.exe	112
PID 2392 wrote to memory of 5896	2392	msedge.exe	112
PID 2392 wrote to memory of 4600	2392	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\Quant Drive\QuantDrive.exe
"C:\Users\Admin\AppData\Local\Temp\Quant Drive\QuantDrive.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --app=http://127.0.0.1:49784 "--user-data-dir=C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --window-size=1760,1000 --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x270,0x274,0x278,0x244,0x2e0,0x7ffe37fac188,0x7ffe37fac194,0x7ffe37fac1a0
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,8473541199860422318,8364582970842608019,262144 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,6997415372697874132,2822626615057706886,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,4269706683835710640,333199712779652622,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,6715584513070047350,1658806706523229699,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,10832597257685835610,14412929208973011356,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,10184255077632702584,14344031682812784681,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,7853253599433108508,3191682478648720012,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:9
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4304,i,14666672817638152669,13951796854364670865,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4324,i,17542763669958268094,2711526109488832178,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:9
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4340,i,12637935909588824628,10371678853465487496,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4372,i,8416069970561209684,702442671735936984,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4296,i,9551739346088921352,10844812064960081077,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4352,i,8606184394784143265,1607145623857258943,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:9
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4384,i,1851378875069991190,17103449664469689859,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:9
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4396,i,2239860849507290218,10758915904468688218,2097152 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:9
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,5702223093212370390,17434538695681006347,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,13819819743379014947,10482045584528070184,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,15225340795069196973,9481169846690126440,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,15225340795069196973,9481169846690126440,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4952965491213673671,5178074709770948025,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=1164 /prefetch:14
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,3372473091432324666,5199540132735028402,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:14
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,17177596091081390601,11157296398085940555,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,4021762995433277095,2168556525084394671,524288 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7144,i,17778346385895424303,17112546737018843776,262144 --field-trial-handle=2500,i,12669490529792879251,7181557832613951071,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Crashpad\settings.dat
Size 280B
SHA256 5d2f7fc77bb4bf09bb16bc1a4de8419f5a6cf76ef348e02f56beefb46824ed78
MD5 0cd5d3b84c5edd31ead8220a4a8c7806
SHA1 1b29daf98a83fe25616cadb2d2e312e5306f4833
SHA512 1873758ee23ea4a65946082197590d0c388196ffbea4ac74b66e83223a8fb38a504bccd66bd5591dcfa6b8b1ec225666010e2fa2bc7cbe02bcf5290f7e849eff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Crashpad\settings.dat
Size 280B
SHA256 2299f7071fd366cb2fbee4b2b7252e75f397b55fe6c29d2537f11f6eb3eb7e66
MD5 da95ad85ce2b439edbd833fe86887f93
SHA1 7a9f8aa06b8d7fe5bd4094ced17849b3b573c1e7
SHA512 8925fe704bd3724c1c087acfbbbf793bc79ee1a404e0d4a2082dd888934d03768f6dd21041d3906acecccc28eec06230b5bf9bf4c4aa429d8f8c920925f71db8
TLSH
T13FD024DC530500C1D3471D310150C7454D0DC040051513C01470041D5CCFC011105104
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3eb5c1b6aac47ef5f94b421a4d49e73283e04d4a11b00e17712fac07765976dc
MD5 163032e4547096b80028fe0f0afea1a9
SHA1 5f0412cbc3e0e74ccf5883a7600560d9d6e88d4c
SHA512 dbd0e6dd3934bf1d849e83c57dfd130d38b31c9cc27d752356d7f3662da595ed1718da5306b49b2734c22a577bcce1d209f96fc6a43ff9c5769c6f9aae86c261
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 d70adfa418771037d592985cd229f11d34ba9bf46c3e913269af5fab946a0bd0
MD5 6672bcd6bd6eb28ffb19bbd7343aa1cb
SHA1 e86081217d87688eba6c9ad5eb4bfee24381b7bc
SHA512 3cc1ab2dfef0c270a752d341e426a0dd4c1acf7f47f13d04e577eca15a01a3851dcbae74f716a16b204d7b0e84213cb15e729600f45d705b53e97ef363664dda
TLSH
T1A6E0A7819ED72085CF2B44745598CCB422458E7388813FAFFA677CC744434F7A643499
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Preferences
Size 9KB
SHA256 ca7cf33823e6fd16f6e2f7b40a23c090d2ff60a04365e893d89a7d4117cbbd5a
MD5 5beaa4c4e59af4d719f92a6cdaefbd80
SHA1 fdaf3d6b1b92c6cef8c5785c41676dbfbc52657e
SHA512 d0db9b730a8a50dd1aac24f4b873a131cd70460de5709cbead3cd98e14b8f307cb319cadc162099758121c6fdbbaeb50ce621750382d841a19d0a0994093aebf
SSDEEP 192:sxRYSUI5/fasoeYOIupW2/gb+WNEuc/dHOh+ehg7J:sxR7UI5/fasoeYmV/ca/w6N
TLSH
T1F812B89A6E28697B5CCBE20ABB75BB53E3F5602191D50E48EBFCC51C05D66CD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Preferences
Size 8KB
SHA256 2271abb59d3e9db4de10a71fd8bf714e20980b3039de724978482010b61f6b79
MD5 c2c6a14b906ff4fa48d4fa047c9b97a9
SHA1 d35a49eef9389a9f1b3232a5e6f92a60df7ec593
SHA512 50ce7ad1fc675a0af3a9fb30d1983eab0f777139e1f103f8a09d9cc631115b03791f780c7ea2c19d83264140819d8e6cce76bf03149415bfb8ad6aaaf36af81e
SSDEEP 192:sxRYSUI5/fasoNYOIupw2/gb+WNEuc/dHf4+ehgJJ:sxR7UI5/fasoNYmj/ca/17z
TLSH
T1A912A89A6E28A97B5CCBE20ABB75BA53E3F5506191D51E48EBFCC51C04D66CC230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Preferences
Size 9KB
SHA256 51fe813eca69a34d5e12d8deb652124a3c01fe255081dd013278ca2f8b404d20
MD5 66af8b8867e2902c66d374d1465e075b
SHA1 66a5cda470879efa69fe9c3a58c56836c64b7fc5
SHA512 df45c03f92035e1761050f207ffefdac473d14ad415ffd359b1d8db17a825705362a83ad7c507461ff67a1761a9d5bc111e0aa7e68649041a354f83d62fc356a
SSDEEP 192:sxRYSUI5/fasoeYOIupw2/gb+WNEuc/dHo4+ehg7J:sxR7UI5/fasoeYmj/ca/G7N
TLSH
T13812B7996E28A97B5CCBE20ABB75BA53E3F5602191C50E48EBFCC51C05D66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a0418.TMP

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Preferences~RFe5a0418.TMP
Size 8KB
SHA256 7da69048847c9fdf1e0d22951ea912b9063cd8796929ab0719e3b23790c7b499
MD5 676658baae6eb45cb003c17e0de23c82
SHA1 4044930d5623a494c389e9bdc219ccd5df00bfb6
SHA512 2ee21353fc5ce0e9a7abffcc778b33428638de17f8f30839f0e00ec2b179d1fb75e15f50c9f7e9bd8ecef8057f5ab82d22b1d71a362989a429e0f8c09f84d8d7
SSDEEP 192:sxRYSUI5/faskNYOIupw2/gb+WNEuc/dHw4+ehgJJ:sxR7UI5/faskNYmj/ca/i7z
TLSH
T1BD02A7966E28A97B5CCBE20ABB75BA53E3F5502191D51E48EBFCC51C04D66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7843f74ed1b6ea44facd4f146ca3f5576345ae79a79c16fc1468628d938c5e1f
MD5 5f0f26d7ec522009b1c963e4f9c78432
SHA1 17e8a10668435c5dcdf05f363e1955283b04dc1c
SHA512 724f0e45270920da11c575e1772b38aaea617651540e75f3a5977b5d371440f84a011e1feeb494e854b79543df0c664c9df378968037746e026e5cb5753faa89
TLSH
T160A002550EC7C862C90912F051C306B533509C958607834BA3D154DEED531E04A83401
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0967.TMP

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index~RFe5a0967.TMP
Size 48B
SHA256 606a7eb266c27330b40b9baf86224d8047f4e24e5bc0f8ee375470093ee354da
MD5 f0dc654f90e8b93a8fa938a9f4165de0
SHA1 cb9f559c594193f58d6fa07c72f9c17f64fb7e4c
SHA512 f378bf18ace042e8d712bb968c2a2ad57497865e5da539dc1986a508a0f975bc15b0f9ca6e31a8634d47fe64ae4fa06297a671f777a13b41dcb862d02b9acd06
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f4280c49-385f-4b48-8927-645464e22d7d.tmp

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Default\f4280c49-385f-4b48-8927-645464e22d7d.tmp
Size 24KB
SHA256 b9f1999b1c3b0c620dd82bf5c71e27d774ea7eae279e155c2cbdc1f832a1908f
MD5 e7a90b23589def883ac12ccc04bb1427
SHA1 7f60a88d02b6414230f6004593e1f8d054d24729
SHA512 2da49fbab97b8a9aecf13071b8f412450624f416cf64df85198ff3acb0d6ba7a8d9220795e27d11dd0d4a353e3976b85ba6e0522ce71748aa55b816ec8e00c96
SSDEEP 768:1NAT52WDQ0ftl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVemzEjroiRkX:1NAT52WDQ0ftlu1jaDCEQiRG
TLSH
T1D4B20A7F604CCB7E9F804A9DDC5A6F9A7E6801C796988D4047FA990C03C77EB911A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State
Size 6KB
SHA256 fdbf383026079abbdbacae8081dafbc8250dd424ae269e4f2a0d2c32e2c134d9
MD5 0a0e2f0c441194a14e9376fff402ff4c
SHA1 8e39184e99aeac6636f8204d5393397fa8f9d6bd
SHA512 65c3455644361bbd3715b1a4217d5d8bef55028db20da4a518a081366fc8f9ecdd9da249de0f64b770078ce0a5fb81ba3a674e84416fac1e45f42a986063005a
SSDEEP 96:zuduiq8NksQvEffghBTtBznvy8Frh/cInURoDotoa5dDDsBB118vtRwCZXg0eUns:zIuZ8NGug5FxooDUphgB1Ew6Xgq9K
TLSH
T189D1A7B56974AD7799F2AE45B58A3713EFB82077D4A53E84DEDC0A1C019728C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State
Size 6KB
SHA256 1456631646189552fd6c072957f0093b3ad671a03665c9c827741343dc83f1a8
MD5 c9230d79f3b0092eea176933b96d4139
SHA1 41012f031af5e86d3e3d91f2aad058ecefbb8535
SHA512 e1ac9c032c606bd4463179ae10832d06a90fce39d95c9369a7f353de6d45be7d55a153f12f43d95c4bc044344d246b5858d1f3f4d44403586883dc849711b189
SSDEEP 96:zuZT+iq8NksQY95EffghBTtBznvy8Frh/cInURoDotoa5dDDsBB118vtRwCZXg0N:zc+Z8NGY+g5FxooDUphgB1Ew6Xgq9/
TLSH
T150D1A6B56D74AD7799F2AE45B58A3713EFB42077D4A53E84DADC0A1C019738C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State
Size 6KB
SHA256 92a2bb92c11a2a5e49690b33e31a65d9c090ef1b45a495a5f7c088cad1706e12
MD5 dede6238493341f58ca6f709802aa481
SHA1 0f08330ae4fb9e8e35d645d3349e66286d5d4e8e
SHA512 f8d0a70fee47c6e78c4ab885111584ed75b08aff918067f18eea4b16283b790738a1e2ec0e747dfc0dce42baa90a7ee1232477fa411eb3e0ecb7b880e90b2260
SSDEEP 96:zud+iq8NksQYaEffghBTtBznvy8Frh/cInURoDotoa5dDDsBB118vtRwCZXg0eUs:zI+Z8NGY7g5FxooDUphgB1Ew6Xgq9K
TLSH
T190D1A6B56D74ADB799F29E45B58A3713EFB82077D4A53E84DADC0A1C01973882306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State
Size 9KB
SHA256 357d39ffc295a329cecaab046e39c45b073be5603988eaf6c2a355647fab509b
MD5 d25d095f89781fdcdbec8f3c133ba105
SHA1 c7f3ce5873df1992c7de2bb0adbf46beda40d84a
SHA512 f83047c55ef28d83529fc8780fae1ddfce2a3670b37a17587ee5ae3ef378b0a876c9f7e964efb51170e8373d03a95295799485c889816953658ed7decd6db007
SSDEEP 192:zK8aZ8NGY+g5FxooDUphgB1xBvgHpf83SWqw6Xgq9K9:zI8NGK5thHbvgHpfgSWqfu9
TLSH
T16612A4B0EDA0AA77ECF69B80B64B7742EFB4216794952E84CDDC190C058379D2307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State
Size 4KB
SHA256 67fd83f1cf0a37418fdb688c144da1837ccd30902d1846d1d32fd399e8b01215
MD5 07ef139c4532ba9a26b96f6fdff73c01
SHA1 624d3f00e4f86c40551bc776986cca654c11b2be
SHA512 049bf26428b5c7a50cd01125bc64536a030f3bb2b903fe4b577752f45a5c853d86c82a5b88bbacf11b803dadf914c7d33d4f331759ed23c9bccdfecc19e8feba
SSDEEP 96:hqGNkGsFffghBTLv1WTJDrB4PlvtRSHOg0eUnHqDqEm3q4a:IGNdGg1UVKxSHOgq9I
TLSH
T1088182B16D347DA7ABF2AF41B59A6613DF7831A7D5622E84EED8162C00D760C2306C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State
Size 5KB
SHA256 919374955335359626fc64589cab86387ade66e0d85e65e4d4f10148ced6e84a
MD5 ee90ce47ddb76de33d0b92c4aa1d3639
SHA1 ac8b2a0d1bbe3b1cc0fc963d6c3a436e188742aa
SHA512 65653e86343b7f60ef4d6378018a4aff47e128aead60645d32227dcbc0ba0f23e8aea8615298b4821e7dcead744dd104ffa2938635002f22110ee335e04dfbd2
SSDEEP 96:hqGNkdQsFffghBTLv58Frh/cInURoDotoudYDEB4PlvtRSHOg0eUnHqDqEm3q4a:IGNFGgqooDUjooKxSHOgq9I
TLSH
T1C3B195B56974BDA7AEF2AE41B4CA7713AFB83177D4953F84DAE80A1C01977481305C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State
Size 14KB
SHA256 1c4d908e78b8d9451d7851d11439622f4ceb19d75bfbbaceb0b774a08cffb03c
MD5 ce0e7127688689bd1f8add245cd63534
SHA1 de07aa2cde3ddd76f0117224187ea30cd30bba69
SHA512 7bce7a75ae468275549b7f86eb6619aa9e4a96a91f024984cc709c71fda1904f23de14a20621fb67fec3e2df81d41a77d7dc3cbec53becb38a7930c3fd6fffb6
SSDEEP 192:zK8aZ8NGY+g5FxooDUpTgB1xBvgHpf83SWVakw6Xgq9F:zI8NGK5tnHbvgHpfgSWPfp
TLSH
T1C8522FF0A8E39933D8AE8783677E6E42AFBCD153B4551A44BBD8090CCD4367FD206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State
Size 14KB
SHA256 49e7ae547702bbf64347844cf0102628ab8855601b7ee6a2f2cab7da2b8efa77
MD5 53eaea881751d6b416dd3c94cc812666
SHA1 c22f26c34c2c94de640c25bffa5f9f3dde31ed0e
SHA512 3c3d045e2604f2c35ca270d764fe75b45e5a0248896c5b06ab19ca257ac7d64a4ac83fbfdadd1c48d4da1c08512df1d005c763b6ba3a8f0bf514ce55548322c4
SSDEEP 192:zK8aZ8NFY+g5FxooDUpTgB1xBvgHpf83SWVakw6Xgq9+:zI8NFK5tnHbvgHpfgSWPfS
TLSH
T1C6522FF0A8E39933D8AE9783677E6E42AFBCD153B4551A44BBD8090CCD4367FD206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59b627.TMP

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\Local State~RFe59b627.TMP
Size 1KB
SHA256 0c4b50b413ee2db03b423f835887384507e2a5af88df85cf890baea133cc1c16
MD5 9d7a7a4bd7ce8fae694e802ff958d07b
SHA1 8734c774c219cbd69777d9ac2d5f6ac5470d76d8
SHA512 41348b4104b5e7f1edd9ef0c6f24569c86c58ff01a43440063612b1147c66c8d0c7e21b0a5b2ebf2a0d6c62544ed001a94e91fa5f1993d69fcc2f81b579e957f
TLSH
T1EB3142F0BD642EB37C91964175CDAB53AF3865B1C1635E8865EC061C01E364C621AC26
MD5 SHA1 SHA512 TLSH

Submit Download

24c2554c-beec-4989-b2e0-c45bc0515e12.tmp

Path C:\Users\Admin\AppData\Local\Temp\Quant Drive\data\webprofile\extensions_crx_cache\24c2554c-beec-4989-b2e0-c45bc0515e12.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 2856506ee4a0b876324051d63fd4a3dbe5bb8ee84fe3c59d204fb47db6a73787
MD5 24d293c6941ddbd1fb664b16519aa5ef
SHA1 3c5ac0b605d0891cb4c70e74d74d2c8c9c1e3ba6
SHA512 829e7c845f257e9de3e22feefbee4ad8c1788db4c03cb14a01c09377acfe2052c75e5bc46c207e01dcb15c65b160cdf02929b53484b3c85f4ab6837b76f9d587
SSDEEP 48:IX1/dOXZ+L4WJ9zpYHLdLXuHWKriTX8/dOXZ+L4WJ9zCNYHggdLXuHWKjQam:8NJpMuLAUJoHIuDq
TLSH
T16491E1019FD52D56F3F7DE7256726A217B37B9496D0C8E0D008551094C72B049AAEFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download