hxxps://czsofts[.]com/dungeondraft/?download=links

Analysis

user interaction
yes
max time kernel
230s
max time network
229s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://czsofts.com/dungeondraft/?download=links
Sample260623-qa671sc17x

Score

7^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
1752	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1800	MSBuild.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5964	powershell.exe
3060	powershell.exe
3156	powershell.exe
5940	powershell.exe
5704	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	msedge.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266934916455817"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{15E0AB51-5864-408B-91B4-CE37B7354E4D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\Z9Tw1RIYO.0cp:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\Build.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\ClinicalIntake.Internal.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\ClinicalIntake.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\ClinicalIntake.csproj:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
3060	powershell.exe
3060	powershell.exe
3060	powershell.exe
3156	powershell.exe
3156	powershell.exe
3156	powershell.exe
5940	powershell.exe
5940	powershell.exe
5940	powershell.exe
5704	powershell.exe
5704	powershell.exe
5704	powershell.exe
5964	powershell.exe
5964	powershell.exe
5964	powershell.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeIncreaseQuotaPrivilege	3060	powershell.exe
Token: SeSecurityPrivilege	3060	powershell.exe
Token: SeTakeOwnershipPrivilege	3060	powershell.exe
Token: SeLoadDriverPrivilege	3060	powershell.exe
Token: SeSystemProfilePrivilege	3060	powershell.exe
Token: SeSystemtimePrivilege	3060	powershell.exe
Token: SeProfSingleProcessPrivilege	3060	powershell.exe
Token: SeIncBasePriorityPrivilege	3060	powershell.exe
Token: SeCreatePagefilePrivilege	3060	powershell.exe
Token: SeBackupPrivilege	3060	powershell.exe
Token: SeRestorePrivilege	3060	powershell.exe
Token: SeShutdownPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeSystemEnvironmentPrivilege	3060	powershell.exe
Token: SeRemoteShutdownPrivilege	3060	powershell.exe
Token: SeUndockPrivilege	3060	powershell.exe
Token: SeManageVolumePrivilege	3060	powershell.exe
Token: 33	3060	powershell.exe
Token: 34	3060	powershell.exe
Token: 35	3060	powershell.exe
Token: 36	3060	powershell.exe
Token: SeIncreaseQuotaPrivilege	3060	powershell.exe
Token: SeSecurityPrivilege	3060	powershell.exe
Token: SeTakeOwnershipPrivilege	3060	powershell.exe
Token: SeLoadDriverPrivilege	3060	powershell.exe
Token: SeSystemProfilePrivilege	3060	powershell.exe
Token: SeSystemtimePrivilege	3060	powershell.exe
Token: SeProfSingleProcessPrivilege	3060	powershell.exe
Token: SeIncBasePriorityPrivilege	3060	powershell.exe
Token: SeCreatePagefilePrivilege	3060	powershell.exe
Token: SeBackupPrivilege	3060	powershell.exe
Token: SeRestorePrivilege	3060	powershell.exe
Token: SeShutdownPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeSystemEnvironmentPrivilege	3060	powershell.exe
Token: SeRemoteShutdownPrivilege	3060	powershell.exe
Token: SeUndockPrivilege	3060	powershell.exe
Token: SeManageVolumePrivilege	3060	powershell.exe
Token: 33	3060	powershell.exe
Token: 34	3060	powershell.exe
Token: 35	3060	powershell.exe
Token: 36	3060	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeIncreaseQuotaPrivilege	3156	powershell.exe
Token: SeSecurityPrivilege	3156	powershell.exe
Token: SeTakeOwnershipPrivilege	3156	powershell.exe
Token: SeLoadDriverPrivilege	3156	powershell.exe
Token: SeSystemProfilePrivilege	3156	powershell.exe
Token: SeSystemtimePrivilege	3156	powershell.exe
Token: SeProfSingleProcessPrivilege	3156	powershell.exe
Token: SeIncBasePriorityPrivilege	3156	powershell.exe
Token: SeCreatePagefilePrivilege	3156	powershell.exe
Token: SeBackupPrivilege	3156	powershell.exe
Token: SeRestorePrivilege	3156	powershell.exe
Token: SeShutdownPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeSystemEnvironmentPrivilege	3156	powershell.exe
Token: SeRemoteShutdownPrivilege	3156	powershell.exe
Token: SeUndockPrivilege	3156	powershell.exe
Token: SeManageVolumePrivilege	3156	powershell.exe
Token: 33	3156	powershell.exe
Token: 34	3156	powershell.exe
Token: 35	3156	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe
5376	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5376	taskmgr.exe
1840	Setup.exe
1840	Setup.exe
5376	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 5696	5808	msedge.exe	88
PID 5808 wrote to memory of 6132	5808	msedge.exe	89
PID 5808 wrote to memory of 2976	5808	msedge.exe	90
PID 5808 wrote to memory of 6132	5808	msedge.exe	89
PID 5808 wrote to memory of 6132	5808	msedge.exe	89
PID 5808 wrote to memory of 2896	5808	msedge.exe	91
PID 5808 wrote to memory of 2896	5808	msedge.exe	91
PID 5808 wrote to memory of 5812	5808	msedge.exe	93
PID 5808 wrote to memory of 5812	5808	msedge.exe	93
PID 5808 wrote to memory of 5812	5808	msedge.exe	93
PID 5808 wrote to memory of 6012	5808	msedge.exe	94
PID 5808 wrote to memory of 6012	5808	msedge.exe	94
PID 5808 wrote to memory of 6012	5808	msedge.exe	94
PID 5808 wrote to memory of 1984	5808	msedge.exe	95
PID 5808 wrote to memory of 948	5808	msedge.exe	96
PID 5808 wrote to memory of 1984	5808	msedge.exe	95
PID 5808 wrote to memory of 1984	5808	msedge.exe	95
PID 5808 wrote to memory of 948	5808	msedge.exe	96
PID 5808 wrote to memory of 948	5808	msedge.exe	96
PID 5808 wrote to memory of 1080	5808	msedge.exe	98
PID 5808 wrote to memory of 5836	5808	msedge.exe	99
PID 5808 wrote to memory of 1080	5808	msedge.exe	98
PID 5808 wrote to memory of 5836	5808	msedge.exe	99
PID 5808 wrote to memory of 6004	5808	msedge.exe	101
PID 5808 wrote to memory of 5656	5808	msedge.exe	104
PID 5808 wrote to memory of 5656	5808	msedge.exe	104
PID 5808 wrote to memory of 5656	5808	msedge.exe	104
PID 5808 wrote to memory of 5856	5808	msedge.exe	105
PID 5808 wrote to memory of 5856	5808	msedge.exe	105
PID 5808 wrote to memory of 5856	5808	msedge.exe	105
PID 5808 wrote to memory of 2512	5808	msedge.exe	106
PID 5808 wrote to memory of 2512	5808	msedge.exe	106
PID 5808 wrote to memory of 2512	5808	msedge.exe	106
PID 5808 wrote to memory of 4480	5808	msedge.exe	108
PID 5808 wrote to memory of 4616	5808	msedge.exe	109
PID 5808 wrote to memory of 5868	5808	msedge.exe	110
PID 5808 wrote to memory of 3200	5808	msedge.exe	111
PID 5808 wrote to memory of 3200	5808	msedge.exe	111
PID 5808 wrote to memory of 3200	5808	msedge.exe	111
PID 5808 wrote to memory of 4376	5808	msedge.exe	112
PID 5808 wrote to memory of 5340	5808	msedge.exe	113
PID 5808 wrote to memory of 4376	5808	msedge.exe	112
PID 5808 wrote to memory of 5340	5808	msedge.exe	113
PID 5808 wrote to memory of 5340	5808	msedge.exe	113
PID 5808 wrote to memory of 1396	5808	msedge.exe	114
PID 5808 wrote to memory of 3676	5808	msedge.exe	115
PID 5808 wrote to memory of 3676	5808	msedge.exe	115
PID 5808 wrote to memory of 2880	5808	msedge.exe	119
PID 1840 wrote to memory of 2820	1840	Setup.exe	121
PID 1840 wrote to memory of 1340	1840	Setup.exe	123
PID 1840 wrote to memory of 3184	1840	Setup.exe	125
PID 1840 wrote to memory of 1692	1840	Setup.exe	127
PID 1692 wrote to memory of 3060	1692	cmd.exe	129
PID 1840 wrote to memory of 3116	1840	Setup.exe	131
PID 3116 wrote to memory of 3156	3116	cmd.exe	133
PID 1840 wrote to memory of 5464	1840	Setup.exe	134
PID 5464 wrote to memory of 5940	5464	cmd.exe	136
PID 1840 wrote to memory of 5548	1840	Setup.exe	137
PID 5548 wrote to memory of 5704	5548	cmd.exe	139
PID 1840 wrote to memory of 5200	1840	Setup.exe	141
PID 5200 wrote to memory of 5964	5200	cmd.exe	143
PID 5808 wrote to memory of 2788	5808	msedge.exe	145
PID 5808 wrote to memory of 1860	5808	msedge.exe	144
PID 5808 wrote to memory of 2788	5808	msedge.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://czsofts.com/dungeondraft/?download=links
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ac,0x7ffed25fc188,0x7ffed25fc194,0x7ffed25fc1a0
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,12775352951858958882,11552717527689631434,262144 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,18173071330074933238,9585763622221028160,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,11996222467595328638,12616576339519010812,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,12844155654102689821,12230575443332683253,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,2273633862520254980,4155778415583124014,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,8026715091511332630,1965792984240002451,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,8480206152036172456,1803886302131921610,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:9
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,12267464852229471806,13584621835228576897,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,14510353972154343975,10904934368349006376,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,11926846551517094608,7365699074299678846,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,11926846551517094608,7365699074299678846,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6032,i,8526197019059963376,10113235330805816303,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3672,i,4252623129507698045,3196042951707780165,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5356,i,13176010274851170639,1720020744281941190,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,15626613333372515552,16043861742123442452,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,5619834959094443155,8173788263030378356,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,11317698355000235282,4718513615641734943,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6044,i,5219995023483065728,13380280357045610411,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,4018540178194521515,4396802513030778434,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:14
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7056,i,14569179963836801788,8469202848774642461,2097152 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,3812371831641825792,17333645631365501162,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,2043835661794306794,8364648946984622861,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7556,i,9300721413446861654,12602123384291245575,262144 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,14859457769821940125,921023733256607808,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,6392206743052583451,4529986624739431035,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,16942338685097438044,4116579708817981016,524288 --field-trial-handle=2300,i,9843052573719212626,17859741999648643272,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\41c13bfc-94d7-4f9b-9a26-a1860bcce3f2_Archive_full_692018.zip.3f2\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\41c13bfc-94d7-4f9b-9a26-a1860bcce3f2_Archive_full_692018.zip.3f2\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:3184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5964
- C:\Windows\system32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY /m Z9Tw1RIYO.0cp /c "cmd /c ren @file Z9Tw1RIYO.bat && call Z9Tw1RIYO.bat"
  2⤵
  - Indirect Command Execution
  PID:1752
- - C:\Windows\system32\cmd.exe
    /c ren "Z9Tw1RIYO.0cp" Z9Tw1RIYO.bat && call Z9Tw1RIYO.bat
    3⤵
    PID:3668
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:2340
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\Z9Tw1RIYO.bat" /launched
      4⤵
      PID:4964
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\Z9Tw1RIYO.bat /launched
        5⤵
        
        PID:2764
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\ClinicalIntake.csproj" /nologo /v:q
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1800

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f979cbb9a6bd39b359e5490b4b29db1d6a8df74089909f02dd3c29cf030e54e1
MD5 d1606b8a9ad0986fe426685b175925f3
SHA1 f2a889c932c02fc9d1e60c13a0a130715569e99c
SHA512 07e98b559a20e05a89eb4be9971e90f6464b4a00c1ba138a8652beb444401d9d1df9ce5ab69e1a207711563eb952a20a13577aebbc6d2c068ed4b782edcb5d61
TLSH
T1E5713D6DCC6A34B1CB2481B900E234B13BB43C429A43EE16185950FDFF8E38D62FA568
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bf20.TMP
Size 3KB
SHA256 476bd41ca6c31c0762be30291fa0f5e4b446228578a389222d0126da0a72bd34
MD5 bb294121567e006c821170f21caaf350
SHA1 a28c50d8847fa0d59f7e7d13706f6387951791fe
SHA512 093a147fd879d064d0650b002a183e4059073f390b954c732856a63ca7697621371573a3992ec669f69dd92a6a5b7a61696440d531033de6396476f653cd9223
TLSH
T1BD712B5DCC6239B1CB2140B900E530B57BB42C429A07EE16185910FCFF8E78C63FA568
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c0247a0d2b46381f29dab1a74d9fb66e93927146f4fc0943d61138fc93849fda
MD5 9bb88d9e0a0ab712e951282183acb0fe
SHA1 d8b5008aa99663e724c647927ab42f3a149956bf
SHA512 6875ec32f7ffba906e081f780d8d0dcb87ab139867f21edf73c8418a3ecb84ee95de6c9f44d59b1037492c71ae0c2b465105c739e94d01fdf918f39806627efa
SSDEEP 192:DY+z+qlelRliccDlcJj9snLH0jhy+cL+J+cs+S+i1j68X+BlplZzlolK+yKRPU/S:DY+z+qlelRliPDlcJj9snLH0Y+cL+J+F
TLSH
T1EB02C0B3C3E8862DD95115F5BB147E1BCD190D2453283D2AC9E5EF4B93E28B1E241A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4fcd2ab3c7a30656cf8f387a962257871ce6f9b62893d10c562914a873b92a49
MD5 0d1b58f90a2b5de0bf9136c5981a13a6
SHA1 13c54549186f2acc8e91192cbd7849973eb31607
SHA512 66e4bdff20b136483da24b322d78ff407bb615cfdca31599cf59600863dc32076b6a31b6b994193cfb016ed777c498afc50d071ee859b398d96880c908dd6258
SSDEEP 192:sxR6RIyM/jK1Ml8wFz/f9sKbDaDVB9pyvMzoA8p3pBCq/g6+WNy4+kcBhJXXYJ5y:sxR6Gbz/f9sKnaBB9p+9p/5RyX53
TLSH
T17962C716A5345A778CDBD609F651BB53D2F85563A2805E44AAFC8B1C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b0a2387d7e72260c844ac1fd6b334101c93948a117af69d4b5ee3dbd9e29ea5b
MD5 c21de8876431185e71d94aacb630cf50
SHA1 4c7fe0847951a83bc22c7d066fb73547158338c1
SHA512 2e51d70499b4e32d5ed0aee90be960ecf3451d3cef7c5808a3a26fb7b058278c5a337b9512f7b1286b0968aa519ab63c96d6f1402fdf8cd4f21e5cdb49666f59
SSDEEP 192:sxRNRIyM/jK1Ml8wFz/f9sNbDaDVB9pKMzoA8p3q/g6+WNXO1/YJ8qGsIgIJ:sxRNGbz/f9sNnaBB9pK9a/54/cs
TLSH
T1C762DA16A6385977CCDBD20DFA517F53D6F80573A2905E44AAFC9B1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 70e5ad10e56861f71fd50d55a17549f3fbbe6ba468945437a40761758589fac9
MD5 84bfa07f6525b45eb0a482b34fa5c78a
SHA1 ee3f8660e7a441162a8f02b11486d87a1ecfa8c3
SHA512 c2ed5e3efcf5957bee77523fa66d12cb9076d4cea16bdadb1ee4bb7657267e69dec2b7bc5ddfb5a1a4074e7d1e016788de82f434be06dab37f8c573090ca4c96
SSDEEP 192:sxR6RIyM/jK1Ml8woz/f9sKIIDaDVB9pyvMzoA8p3pBCq/g6+WNy4+kcBhJXCr/X:sxR6GOz/f9sKIYaBB9p+9p/5Ryy/11
TLSH
T11E72B616A5345A778CDBD60DFA51BB53D2F85563A2C05E44AAFCCB1C00E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4a1b8636cfb64250e0a62f558e8dde91fe8533f97d9c0df2895cae2cce03185d
MD5 11c0347db936a1c164b93d1d54bdf963
SHA1 e4f6c6347787d7ed93c11b908d0c98a2221ea19d
SHA512 9589f528a2080c3b7c1f982f450392a90c21b92b31314a5cdedd2c88b1f21823639890ba87c0a066e99d4ddefc22bbf17509bfad1f44bbe6e9b3831b34490d2f
SSDEEP 192:sxR6RIyM/jK1Ml8UQboz/f9sKIIDaDVB9pyvMzoA8pVpBCq/g6+WNy4+kcBhJXCE:sxR6Gqkz/f9sKIYaBB9p+9T/5Ryy/K1
TLSH
T18772B516A5345A778CDBD60DFA51BB53D2F85563A2C05E44AAFCCB1C00E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2b987f90071190f612ee3966dae3c7086d6a9c67b254d86b8d5b977ab3abf2c7
MD5 35ff62dbbabb49648b5c322e14dd3d86
SHA1 ca8b864d6f5a73ccaddee255546b74687f86567a
SHA512 47cc61cb40360c42f87ceef31ab6861f55ba12e9390a4ff7da346c347e61614a5c6b6a5bb6b900adc5c9d3f85b9b7d0b642e127cd1d5d16fab26cfda7476a511
SSDEEP 768:v1D847WgeEfLq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpDZhwrol2ZFr:v1D847WgeEfLqu1ja0NhbK
TLSH
T1C5C20B3B640CC77E4F844A6DAC29AED66DD801CB97988D5447EA8C0C03CA7FB521A5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\b69be93b-9fc7-4fb7-a3ea-de61299d9191\17
Size 10.0MB
SHA256 e5b844cc57f57094ea4585e235f36c78c1cd222262bb89d53c94dcb4d6b3e55d
MD5 f1c9645dbc14efddc7d8a322685f26eb
SHA1 8c206a1a87599f532ce68675536f0b1546900d7a
SHA512 868d3a190f2723758d1a64498a4ac1f14b0297e16e731a0eec3a446b775c65cb8428ab33140cee13ef51e7bb3764b5ff1900cfb342a3dbf3fcc41dd6cdd9fcea
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

f87e05cf-3526-4dab-8dbc-e60a71097e1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f87e05cf-3526-4dab-8dbc-e60a71097e1b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59dff6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59dff6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e8a7f4c0608a620eb467d235331fe9e948c6836ff467e2715b775b5b7809c555
MD5 ed6de5375173eb7a4ebf6fcfa25e6dc5
SHA1 311d63650516475479c9d380bbb81236dcd90b0f
SHA512 4f8e322dad471238a086b5da8962d94f0f0882464f04992b1a33609d1f9c6350e3f2fbb3e0ed748320d1468fe6b045e5b468d06736b9ac53c80e32390b5072c4
SSDEEP 768:ujaeqD4MlshiLdMmi3hO5GUtwVCgZSVCKPFECrBhpjcNf/+0TT1:uqcjhIdMh3ww8gs0KPF1HRct/x
TLSH
T18513CF76A8B46E774CB79555B207B2826EB40297C2CA3E4D98DD6B0D05C73ED2307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0953ea335a051fa46b92f74b82d2a1597c46c9ced42599315823c09a1eebf32c
MD5 b0c9763e3a313fcf0097207ee2ede9f0
SHA1 afc802c09e4ebd118cb4b5cd58d149aea841820c
SHA512 49ad32e9c0c2ba3a8a876f1c3490ffe068d5975fdf3c74b5801e39159d01a891e8eb7fa87605f899853658e538cc77c2b0270f3e89052e7ff4e67254255b82e0
SSDEEP 768:Jj+9U3NO5GUt5VCgZSVCKPFECrBhpjcNf/+0ZvK:U9U3E58gs0KPF1HRct/9vK
TLSH
T177F2CF32B8B4AE374CE68695B10B72466EF4079792C92E4989DC7B0D49CB3ED1347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 26a4c5b2b2aac5d97479202b8189b139d66e71526c025dfa37bb61ef0ce3a2a9
MD5 a32b6d5d90919a74c423c91ee5bab6e0
SHA1 bcf43d8508d5896caca9b740fc92d797040a20e9
SHA512 f9ac01704d691f4a3404f2fce587b074a00cf17c38fb500e8d754b3dbc94c888d4c50049892c049283bdf0490c9698674f8135efc5b39142562cf04ab10984dc
SSDEEP 768:Jj+9U3tO5GUt5VCgZSVCKPFECrBhpjcNf/+0ZvK:U9U3k58gs0KPF1HRct/9vK
TLSH
T1BBF2CF32B8B4AE374CE68695B10B72466EF4079792C92E4989DC7B0D49CB3ED1347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 c3a05a189cea91529ec07d61f7555addac9b4b47744caf1038da74c7ea932da4
MD5 52c5293a3ea232c3abb70130332a498a
SHA1 7243dc580bbcb0864117a3b692e69e2e50b2627a
SHA512 6e5762411119ca14dffe58fd09d30c6c8a84a87607ea15461a839a8f55411756440e6946c8ec6a21ab85ab3474a6a007d0a682849d14bd15fa1dea06175ef748
SSDEEP 768:bF1j+9D3MwgRfO5GUt2VCgZSVCKPFECrBhpjcNf/+0ZvK:69D3V28gs0KPF1HRct/9vK
TLSH
T158136CF258D39936CCAE8B57A33E2D055EBCC293B1856944B7C85A0CCC862BFD346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3d7141110981b528480d0904f1b7ec0092e286fb81250cf7811b1b7c8c170f21
MD5 eeb5f18bedbe3814a96c3c47533a2d98
SHA1 fd62f4ee548931256a157e1acb02a9ef47bc3cfe
SHA512 f8433bbcf4349ad10ac9ef4db1ecfbd9db89413d7e664dff0a47bad935b5e998522f8dd58e5faded59abddc1d3454c1fcf6c2c6c57acdaf7e7eeb81d0ae88c86
SSDEEP 768:Rj+9U3mO5GUt5VCgZSVCKPFECrBhpjcNf/+0ZvK:M9U3z58gs0KPF1HRct/9vK
TLSH
T1FDF2CF32B8B4AE234CE6D694B10B72466EF4079792C92E4989DC7B0D49CB3ED1347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 772fb5f5222f13f5f9b3a6ae0b467c3b85306c8aeb09cf7220fd00739dcb508d
MD5 b40abee9317fa215da7a1af59ec25259
SHA1 cd648ebdd40e39bad8543a3f2765452ba02e3772
SHA512 309599d6e8467fae692c5c851af547c9c43052f6aec1db6d0867c993baaa2356f4c0b7088b1ce0f39ec7300f7162df1bc52bac158beea437c9aaeabaa5e21787
SSDEEP 768:bjaeqD4MlshiLdMmu3Nf5GUuVCgZSVCKPFECrBhpjcxn4+ApX32TB:bqcjhIdMB3i8gs0KPF1HRcd4+KXk
TLSH
T16B03CF7AA8A45E738CB7D645B207B1466EB842D7D2C92F8CD8DD6A0D41D72DE1303C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 ec3d9ed06773545dadbe86297ba84a25ce49fe39ebd37835a1251b9905bfc4cc
MD5 36dbbdd54a5991087ba3a4fada90fbd8
SHA1 aa13f442419d9117e9176b9dc65ca1b8806967ee
SHA512 abed2176462fa33366d0f0097392a5f4a9950e3c65b2b03e9f63c20962e229c759b62c9d868fb88e7b5161240432b2ffea1ba58d70b0915750f38a38e4d7b892
SSDEEP 768:bFcj+9E3MwgNfO5GUtLVCgZSVCKPFECrBhpjcNf/+0ZvK:R9E31L8gs0KPF1HRct/9vK
TLSH
T102136CF258D79936C8AE8757A33E2D455EBCC293B1856944B7C86A0CCC862BFD306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd3f6e43-9efa-4a25-b4ae-51e9e2103ff4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fd3f6e43-9efa-4a25-b4ae-51e9e2103ff4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a9b314870f830d9f02ab8003b5eb237824487db1a411b87885d1fa37ab099ded
MD5 225395863596057df678b4ff4fb1a485
SHA1 9f3ea33bb2704534b225661d0baa3236b3c87f18
SHA512 98bc116c8e7d13da3ca45c38b792596793e4d26d80697f7efd12963ab50e8475c159f40370d1d679301791f38797b228400410f7dbbc4716d96c8a3736594ba5
TLSH
T173318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B84E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 146735a19b5bf634ed536ed2b04ef4c9fe60bfa9de63a76d525bf2d3648672b0
MD5 77c9a6e491396b8b6eb958070dd59916
SHA1 477daa8a7ea9c7fa2c53182cc2461200c9354dd0
SHA512 aaaf76344ca933d1ade3b77de25cc109642787f7b65d0c482e610420f541e44c73df147a7982ee4aea2f2103bb01c7c8f626156b7c20d469ad6826ff29a09cf8
TLSH
T115219833F3DC8214DC99413A10DDAC1036B6C7CB40DECF9B6B81E159A42F299CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 590f02f280b565bf28e15afd4d63be3e827beec683033e0d358eff86b24afbf7
MD5 dcaef8e414401a73498a4314db0d9d0f
SHA1 ca1f156060c07a2cd0e201f2dcbc6189d44474a3
SHA512 1b6e40b25cf57fd8ef5fd0d0c5650b360255b5a372464d401c3dd71a41f1cda10514db9ade07eeed62e668b3c0951525456afd10065d4382d0dac36556af20c5
TLSH
T1A3219833F3DC8224CC99013A10DDAC1036B6C7DB40DECF9B6B81E159A82F698DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 64232b71ba9077c7cc236280f828066ed55656333fbb861c652be336cf358c73
MD5 4e555728a9b5d913629baa19b66703f7
SHA1 5982b3a84b8a12741316027404f5deb730a47c92
SHA512 606ffef7e3831d73026c38fc34ced8423025eb34803c517cfef8c2701aad2e3f0d1e0a7f3dc000819fa5be07ebdce5a68af7111126b2481d3d8dd4e81e8930f4
TLSH
T136219837F3DC8214CCAA003A10DDAD0036B6C7CB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ne2kmk0i.l4k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ne2kmk0i.l4k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Build.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\Build.props
Size 610KB
SHA256 95ea79299f83e17a771ae7ecd62a5c21ade563e95f5f703a48ef554a04419093
MD5 9611d18e83f7d8713522652c6ba793f8
SHA1 8b37e80364c476c7d9bf02a6e2d4d5d0d5e271e6
SHA512 041fa8d6fcea13086873d9d5ec769484664c07fbb90ab7663af32a4768efdd8997cebc466d524d91fe603c97ad80e620174e2c872e4da33e95bcb2ce1d57d648
SSDEEP 6144:WAdQ5U+Qn3BRAwXQ4+95QdMneoX2RjkWXZUSNeMNQ/HA3/Q6WalCwKUw8KKwe02f:WAK55cMgN1Dk9MEqj7GKi3Xj2H
TLSH
T1E9D44A727817FE9B1773CF43519574000C3E793B75148968FAC84169A2FA92EEEA8CB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClinicalIntake.Internal.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\ClinicalIntake.Internal.targets
Size 1.3MB
SHA256 0c2b39bd5692b7caebbfb430c8a4061529a795cf24e8269ac831165852bce504
MD5 7f2cfb64310370fd0f916dd4cc37c7ab
SHA1 94db7187f1ba31e1f8fa346603f658d1d3899a6b
SHA512 700233fb32d24eebb6dfe48b94c5610a5355fabddeb2c32c32c778f888968b39f2977bc94daca1280af5441f039c8f0733f44f0624926f8c3ea7d7ab7af4522b
SSDEEP 24576:fsb1pMTobC3mr31rwvoENCL6AM20M7FRkB:YBCEffPI
TLSH
T1A155F7775E56BDDABA3F1EC0A6412102BDE8256B1738E1BC7E45200237E3698DC78E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClinicalIntake.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\ClinicalIntake.csproj
Size 9.0MB
SHA256 790ab79ee4025c60808a89d73fed9e7f952f03648fec5d4e5d6fff8ba77c6cb8
MD5 6ac34a144d0d8c14254d1a32130222f0
SHA1 511614be70fbdb68bc2127dd606c4f992eb0cc2c
SHA512 755a5eee73e1d642a153d0ab9f28297f64f0a42a808aa7965c69e99c41ab7ef97c387c367179c6b78f7f80b9d02b69099feb2dc93f6747f0fe6ceac2416fe964
SSDEEP 1536:FtAKWD4LdggN+/HtcKMm2t/vDQwQMFVi6Uzge3FSwgZBLFTfQspC1savXO2mhmBu:H
TLSH
T124A6D37A079047BBE3D447D4882B215E36F5E525BA242159B73369EFBC2A9CBC038743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClinicalIntake.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\ClinicalIntake.csproj.user
Size 589KB
SHA256 467503fa0b671eef6004cc56920546dff7a8cd468b9cd099ee33f47e3c2d2d5b
MD5 cda3ab2460f2de33196938bada424f2f
SHA1 2efd9b32ebe8fc8bdf572f2c0303e034eeb58bad
SHA512 3e3f6260586ec101790b88aae7fc585ac18de0a5967f217eba44c24738838e25ec36e7421614a64c5e24f6cdc5af664e7f8edeb720903f50818ad32619071809
SSDEEP 3072:gsrhtJo/Bz3eoqPrIWgVwHi8bzVJoRycMcZ170H8f4cS+f:gQro/Bz3TqTIWgUi8bzVJo8cMUP
TLSH
T11BD42271110FFE9B143AC906F85E54461C813273F41A54DBF2D8883FE6A71AAAE78CD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClinicalIntake.csproj.user:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\ClinicalIntake.csproj.user:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

Z9Tw1RIYO.0cp

Path C:\Users\Admin\AppData\Local\Temp\tmp-72603-KB8JDdOTAatY\Z9Tw1RIYO.0cp
Size 1KB
SHA256 139460593c60a4a17a48e5165ab0b1254da2e0154a2b87a79b179c2769d34560
MD5 d5d67a1200b7cfcf114192b0107ce924
SHA1 49d5bd61c2d99a8090751e102ffa9208917680d0
SHA512 c134ec3da37e61129b97f88bf10498a5a5e9f0bba4898435f3e8f91d5af0da9e33e08274bc1e3a06f920f0330900ef8dbf2f9486a7c0f78e2fbf959fb967c784
TLSH
T13D219B977522159DD8E132BA27758333120D72833484F4BCB1C4C9AD749F47FAA912E4
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/1800-847-0x0000023EDD930000-0x0000023EDDB0C000-memory.dmp

Download

memory/1800-860-0x0000023EDCD00000-0x0000023EDCFF8000-memory.dmp

Download

memory/1800-840-0x0000023EC4BA0000-0x0000023EC4BD0000-memory.dmp

Download

memory/1800-837-0x0000023EDD630000-0x0000023EDD78A000-memory.dmp

Download

memory/1800-836-0x0000023EC3350000-0x0000023EC336A000-memory.dmp

Download

memory/1800-835-0x0000023EC2E90000-0x0000023EC2ECE000-memory.dmp

Download

memory/3060-721-0x0000028FF6CE0000-0x0000028FF6CFE000-memory.dmp

Download

memory/3060-708-0x0000028FDEBB0000-0x0000028FDEBD2000-memory.dmp

Download

memory/3060-722-0x0000028FF6D00000-0x0000028FF6DB2000-memory.dmp

Download

memory/3060-723-0x0000028FF6DC0000-0x0000028FF6DCA000-memory.dmp

Download

memory/3060-724-0x0000028FF6E00000-0x0000028FF6E2A000-memory.dmp

Download

memory/3060-725-0x0000028FF6E00000-0x0000028FF6E24000-memory.dmp

Download

memory/3156-740-0x0000028124350000-0x0000028124402000-memory.dmp

Download

memory/5376-793-0x00000204B6070000-0x00000204B6071000-memory.dmp

Download

memory/5376-784-0x00000204B6070000-0x00000204B6071000-memory.dmp

Download

memory/5376-795-0x00000204B6070000-0x00000204B6071000-memory.dmp

Download

memory/5376-794-0x00000204B6070000-0x00000204B6071000-memory.dmp

Download

memory/5376-792-0x00000204B6070000-0x00000204B6071000-memory.dmp

Download

memory/5376-786-0x00000204B6070000-0x00000204B6071000-memory.dmp

Download

memory/5376-791-0x00000204B6070000-0x00000204B6071000-memory.dmp

Download

memory/5376-790-0x00000204B6070000-0x00000204B6071000-memory.dmp

Download