Overview

overview

7

Static

static

1

URLScan

urlscan

1

https://spaces.hight...

windows10-2004-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    628s
  • max time network
    627s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/06/2026, 11:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://spaces.hightail.com/receive/Cy9q62UK1w
  • Sample260624-nwbbcsby2p
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 43 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 4 IoCs
    defense_evasionprivilege_escalation
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 14 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://spaces.hightail.com/receive/Cy9q62UK1w
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x29c,0x7ffc9cffc188,0x7ffc9cffc194,0x7ffc9cffc1a0
      2⤵
        PID:2632
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,2745199000143852450,3727926954164599210,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
        2⤵
        • System Time Discovery
        PID:4820
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,8133390860495935534,17428652455112663064,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
        2⤵
          PID:1064
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4640786970720322321,7995534918234747821,262144 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
          2⤵
            PID:4224
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2403288360697229519,17791724664563693496,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
            2⤵
              PID:4604
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,3056558077732610811,2031019281512464549,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
              2⤵
                PID:856
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,16350010303528270612,7434090470378228916,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
                2⤵
                  PID:432
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,17132307400826674459,1395676120353681665,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
                  2⤵
                    PID:4036
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,2163329809191834172,14718103222414096580,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
                    2⤵
                      PID:2728
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,12151311867024536331,5485611321707626465,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
                      2⤵
                        PID:4852
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,11501518182688579843,6062555225563323997,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
                        2⤵
                          PID:1068
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,11501518182688579843,6062555225563323997,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
                          2⤵
                            PID:2104
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,2501973727796599920,6786944031106385000,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
                            2⤵
                              PID:3388
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,18386626250475260758,2317864550800557137,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
                              2⤵
                                PID:3000
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6688,i,9138458935014518857,4445677770759984946,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
                                2⤵
                                  PID:2160
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6556,i,5521292399752397174,1577759916221669160,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
                                  2⤵
                                    PID:5096
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3608,i,14203306635826865495,5505422912661328931,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
                                    2⤵
                                      PID:5288
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,7996082137781615933,802783609601060740,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
                                      2⤵
                                        PID:5496
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,1049284938741880895,3068395175569180587,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
                                        2⤵
                                          PID:5504
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,3864244541984874265,15889434972922859528,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
                                          2⤵
                                            PID:5512
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,8792502678069959585,14119526778615861848,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
                                            2⤵
                                              PID:5644
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5276,i,4399833369340478810,5159812453182088540,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
                                              2⤵
                                                PID:5652
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6972,i,2436445334369740452,9943711230074884092,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
                                                2⤵
                                                  PID:5944
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4488,i,13035403396416658506,3568188807294543792,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
                                                  2⤵
                                                    PID:6096
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,17402624494547677751,11085451615919535933,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
                                                    2⤵
                                                      PID:4836
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7788,i,12542735216035083488,14527385034767241937,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:8
                                                      2⤵
                                                        PID:3868
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,14007121376731481809,8976191829068940690,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
                                                        2⤵
                                                          PID:3244
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7948,i,8592570786463562253,11850985582982641074,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
                                                          2⤵
                                                            PID:4420
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5004,i,13671926279061175164,4249199116934069881,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
                                                            2⤵
                                                              PID:3460
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8104,i,4426665681403289171,9498276437325219533,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:1
                                                              2⤵
                                                                PID:5296
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7872,i,10448407172952378867,16187409971076641296,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
                                                                2⤵
                                                                  PID:4828
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8140,i,9243388220568580463,17929178327569835436,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:1
                                                                  2⤵
                                                                    PID:4944
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7420,i,13845706220268154967,10030516601930817463,2097152 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
                                                                    2⤵
                                                                      PID:5760
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7900,i,8092619533847606349,17726778640053342919,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
                                                                      2⤵
                                                                      • Enumerates connected drives
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2880
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5372,i,9020276474833197537,7300096537768223900,262144 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:8
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4160
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,15481371328027165139,14809008493177749069,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:8
                                                                      2⤵
                                                                        PID:3396
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,13617225623880839178,1668468358259372482,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:8
                                                                        2⤵
                                                                          PID:3708
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9004,i,10692971919945344661,4382129294969387432,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:8
                                                                          2⤵
                                                                            PID:3772
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9000,i,8268333243873158381,9027413979198527967,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:8
                                                                            2⤵
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:312
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9188,i,10292807517553337291,1774362495953301364,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:8
                                                                            2⤵
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                            • Suspicious use of SendNotifyMessage
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5076
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8884,i,4863051494435902424,17119014802423003669,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=9180 /prefetch:8
                                                                            2⤵
                                                                              PID:6112
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8072,i,18285281400525093183,7152675196813071026,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:8
                                                                              2⤵
                                                                                PID:3392
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8920,i,14996046251863347846,11217262212630140557,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=1540 /prefetch:8
                                                                                2⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:812
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1520,i,9682728181836680153,5602907760999558492,524288 --field-trial-handle=2316,i,3287370357956667152,3182164790903335737,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
                                                                                2⤵
                                                                                  PID:5240
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:1120
                                                                                • C:\Windows\System32\rundll32.exe
                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                  1⤵
                                                                                    PID:1648
                                                                                  • C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\3mensio.Setup.exe
                                                                                    "C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\3mensio.Setup.exe"
                                                                                    1⤵
                                                                                    • Loads dropped DLL
                                                                                    • Enumerates connected drives
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5740
                                                                                    • C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckDotNetVersion.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckDotNetVersion.exe" Microsoft.WindowsDesktop.App 6.0.18
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4500
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""%ProgramFiles%\dotnet\dotnet.exe"" --list-runtimes
                                                                                        3⤵
                                                                                        • System Time Discovery
                                                                                        PID:5228
                                                                                        • C:\Program Files\dotnet\dotnet.exe
                                                                                          "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
                                                                                          4⤵
                                                                                          • System Time Discovery
                                                                                          PID:5688
                                                                                    • C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckDotNetVersion.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckDotNetVersion.exe" Microsoft.AspNetCore.App 6.0.18
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:3232
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""%ProgramFiles%\dotnet\dotnet.exe"" --list-runtimes
                                                                                        3⤵
                                                                                        • System Time Discovery
                                                                                        PID:5720
                                                                                        • C:\Program Files\dotnet\dotnet.exe
                                                                                          "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
                                                                                          4⤵
                                                                                          • System Time Discovery
                                                                                          PID:1680
                                                                                    • C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckSentinelVersion.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckSentinelVersion.exe" 8.41.130417.1 8.41.10417.60001
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3636
                                                                                    • C:\Users\Admin\AppData\Local\Temp\3mensio Workstation Setup\ASP.NET Runtime\SetupLauncher.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\3mensio Workstation Setup\ASP.NET Runtime\SetupLauncher.exe" aspnetcore-runtime-win-x64.exe /passive
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Time Discovery
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3992
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c aspnetcore-runtime-win-x64.exe /passive
                                                                                        3⤵
                                                                                        • System Time Discovery
                                                                                        PID:2356
                                                                                        • C:\Users\Admin\AppData\Local\Temp\3mensio Workstation Setup\ASP.NET Runtime\aspnetcore-runtime-win-x64.exe
                                                                                          aspnetcore-runtime-win-x64.exe /passive
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • System Time Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5632
                                                                                          • C:\Windows\Temp\{7575C594-C4D6-4B0C-9719-E3AC7949593B}\.cr\aspnetcore-runtime-win-x64.exe
                                                                                            "C:\Windows\Temp\{7575C594-C4D6-4B0C-9719-E3AC7949593B}\.cr\aspnetcore-runtime-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\3mensio Workstation Setup\ASP.NET Runtime\aspnetcore-runtime-win-x64.exe" -burn.filehandle.attached=588 -burn.filehandle.self=584 /passive
                                                                                            5⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • System Time Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3696
                                                                                            • C:\Windows\Temp\{71F6C91D-6550-4362-A964-74DCC4C98C78}\.be\aspnetcore-runtime-6.0.18-win-x64.exe
                                                                                              "C:\Windows\Temp\{71F6C91D-6550-4362-A964-74DCC4C98C78}\.be\aspnetcore-runtime-6.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{1054DCCE-4AAC-446F-868A-EB19FD7D644D} {A9E6A32E-075E-414A-84C7-AA5DD59A1C61} 3696
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • System Time Discovery
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:5496
                                                                                    • C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckDotNetVersion.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckDotNetVersion.exe" Microsoft.AspNetCore.App 6.0.18
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4676
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""%ProgramFiles%\dotnet\dotnet.exe"" --list-runtimes
                                                                                        3⤵
                                                                                        • System Time Discovery
                                                                                        PID:1824
                                                                                        • C:\Program Files\dotnet\dotnet.exe
                                                                                          "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
                                                                                          4⤵
                                                                                          • System Time Discovery
                                                                                          PID:5500
                                                                                    • C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\3mensio.Setup.exe
                                                                                      "C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\3mensio.Setup.exe" /i "C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\F725EE8\3mensio.Setup.msi" AI_EUIMSI=1 FOLDER_PRODUCTVERSION="C:" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\3mensio Workstation" APPDIR="C:\Program Files\3mensio Medical Imaging\3mensio Workstation" APPDIR.CE6817C1_13A3_49B0_B78A_94FACFD83081="C:\Program Files\3mensio Medical Imaging\3mensio Workstation" SECONDSEQUENCE="1" CLIENTPROCESSID="5740" AI_MORE_CMD_LINE=1
                                                                                      2⤵
                                                                                      • Enumerates connected drives
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4484
                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                    1⤵
                                                                                    • Enumerates connected drives
                                                                                    • Drops file in Program Files directory
                                                                                    • Drops file in Windows directory
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1600
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding C43D57563111282FC226267A3E01682A C
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:5464
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 860611812AAC4C04ADDB71EEF56FF363
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:5556
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 06F641192961E016AE924008D7AC5C49 C
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2228
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding D3201D337B728C3DBAEFB92683195884
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:2372
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss621B.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi6208.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr6209.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr620A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                                                                        3⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:4008
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding DFC250A7D24F7A895505DAC9CB68D94D E Global\MSI0000
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Program Files directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:4408
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssB0D7.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiB0C5.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrB0C6.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrB0C7.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                                                                        3⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:980
                                                                                    • C:\Windows\Installer\MSI95FC.tmp
                                                                                      "C:\Windows\Installer\MSI95FC.tmp" /RunAsAdmin /HideWindow "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe" -createadminsettings
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Access Token Manipulation: Create Process with Token
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:3328
                                                                                      • C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe
                                                                                        "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe" -createadminsettings
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        PID:2860
                                                                                    • C:\Windows\Installer\MSI9C75.tmp
                                                                                      "C:\Windows\Installer\MSI9C75.tmp" /RunAsAdmin /HideWindow "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe" -install
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Access Token Manipulation: Create Process with Token
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:5560
                                                                                      • C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe
                                                                                        "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe" -install
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Checks processor information in registry
                                                                                        PID:332
                                                                                    • C:\Windows\Installer\MSIA428.tmp
                                                                                      "C:\Windows\Installer\MSIA428.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Windows\SysWOW64\xcopy.exe" "C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\\Manuals" "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\\Manuals\" /S /Y /Q /I
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Access Token Manipulation: Create Process with Token
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3516
                                                                                      • C:\Windows\SysWOW64\xcopy.exe
                                                                                        "C:\Windows\SysWOW64\xcopy.exe" "C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\\Manuals" "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\\Manuals\" /S /Y /Q /I
                                                                                        3⤵
                                                                                        • Drops file in Program Files directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Enumerates system info in registry
                                                                                        PID:1424
                                                                                    • C:\Windows\Installer\MSIA745.tmp
                                                                                      "C:\Windows\Installer\MSIA745.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Windows\SysWOW64\xcopy.exe" "C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\\Resources\RegionalInfo.pdf" "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\\Resources\" /Y /Q /I
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Access Token Manipulation: Create Process with Token
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:5172
                                                                                      • C:\Windows\SysWOW64\xcopy.exe
                                                                                        "C:\Windows\SysWOW64\xcopy.exe" "C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\\Resources\RegionalInfo.pdf" "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\\Resources\" /Y /Q /I
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Enumerates system info in registry
                                                                                        PID:5060
                                                                                    • C:\Windows\Installer\MSIA831.tmp
                                                                                      "C:\Windows\Installer\MSIA831.tmp" /HideWindow eventcreate /ID 1 /L APPLICATION /T INFORMATION /SO "3mensio Workstation" /D "Event log source created."
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:3268
                                                                                      • C:\Windows\SysWOW64\eventcreate.exe
                                                                                        "C:\Windows\System32\eventcreate.exe" /ID 1 /L APPLICATION /T INFORMATION /SO "3mensio Workstation" /D "Event log source created."
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5480
                                                                                  • C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\3mensio.Setup.exe
                                                                                    "C:\Users\Admin\Desktop\3mensio Workstation 10.4 SP4\3mensio.Setup.exe"
                                                                                    1⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2728
                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                    C:\Windows\system32\vssvc.exe
                                                                                    1⤵
                                                                                    • Checks SCSI registry key(s)
                                                                                    PID:5848
                                                                                  • C:\Windows\system32\srtasks.exe
                                                                                    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                    1⤵
                                                                                      PID:5764
                                                                                    • C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe
                                                                                      "C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe" /burn.runonce
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • System Time Discovery
                                                                                      PID:6124
                                                                                      • C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe
                                                                                        "C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe" /passive /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260624124959.log"
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5832
                                                                                        • C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe
                                                                                          "C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=528 /passive /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260624124959.log"
                                                                                          3⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2788
                                                                                          • C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe
                                                                                            "C:\ProgramData\Package Cache\{dd6243d3-bc6c-433a-8bd3-510291c4f354}\aspnetcore-runtime-6.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{B854E61B-1496-4D53-AE7C-BE76D6BE70CC} {9CC1CF90-D364-40EC-BDDE-AB90DC4B7041} 2788
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • System Time Discovery
                                                                                            PID:1804
                                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
                                                                                      1⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3356
                                                                                    • C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe
                                                                                      "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe"
                                                                                      1⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      PID:3264
                                                                                    • C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe
                                                                                      "C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Archive.exe"
                                                                                      1⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      PID:5480

                                                                                    Network

                                                                                          MITRE ATT&CK Enterprise v16

                                                                                          Reconnaissance

                                                                                          Resource Development

                                                                                          Initial Access

                                                                                          Execution

                                                                                          Command and Scripting Interpreter

                                                                                          1
                                                                                          T1059

                                                                                          PowerShell

                                                                                          1
                                                                                          T1059.001

                                                                                          Persistence

                                                                                          Boot or Logon Autostart Execution

                                                                                          1
                                                                                          T1547

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1547.001

                                                                                          Event Triggered Execution

                                                                                          1
                                                                                          T1546

                                                                                          Component Object Model Hijacking

                                                                                          1
                                                                                          T1546.015

                                                                                          Privilege Escalation

                                                                                          Access Token Manipulation

                                                                                          1
                                                                                          T1134

                                                                                          Create Process with Token

                                                                                          1
                                                                                          T1134.002

                                                                                          Boot or Logon Autostart Execution

                                                                                          1
                                                                                          T1547

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1547.001

                                                                                          Event Triggered Execution

                                                                                          1
                                                                                          T1546

                                                                                          Component Object Model Hijacking

                                                                                          1
                                                                                          T1546.015

                                                                                          Defense Evasion

                                                                                          Access Token Manipulation

                                                                                          1
                                                                                          T1134

                                                                                          Create Process with Token

                                                                                          1
                                                                                          T1134.002

                                                                                          Modify Registry

                                                                                          1
                                                                                          T1112

                                                                                          Credential Access

                                                                                          Discovery

                                                                                          Browser Information Discovery

                                                                                          1
                                                                                          T1217

                                                                                          Network Share Discovery

                                                                                          1
                                                                                          T1135

                                                                                          Peripheral Device Discovery

                                                                                          2
                                                                                          T1120

                                                                                          Query Registry

                                                                                          6
                                                                                          T1012

                                                                                          System Information Discovery

                                                                                          6
                                                                                          T1082

                                                                                          System Location Discovery

                                                                                          1
                                                                                          T1614

                                                                                          System Language Discovery

                                                                                          1
                                                                                          T1614.001

                                                                                          System Time Discovery

                                                                                          1
                                                                                          T1124

                                                                                          Lateral Movement

                                                                                          Collection

                                                                                          Command and Control

                                                                                          Exfiltration

                                                                                          Impact

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          e5d2aaf.rbs
                                                                                          • Path C:\Config.Msi\e5d2aaf.rbs
                                                                                          • Size 39KB
                                                                                          • SHA256 08c6574013732ad19e5995ed90bb4777d790d523f36c2e5a10326aecf682cd65
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          e5d2ab2.rbs
                                                                                          • Path C:\Config.Msi\e5d2ab2.rbs
                                                                                          • Size 5.3MB
                                                                                          • SHA256 3053a361cfa8c0f3da75a98b026c1ddc38e747e7441bb1422f69016bd0882e8d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.ArchiveProxy.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.ArchiveProxy.dll
                                                                                          • Size 546KB
                                                                                          • SHA256 935b99ac5e1693a9412aa1989cae914da089d8ced1d9491e6908c4830132f647
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Controls.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Controls.dll
                                                                                          • Size 349KB
                                                                                          • SHA256 e02e22a91b5d2ef2bb726e51cbd7badf74640e11e0b9e8e8469011baefc39cce
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Dicom.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Dicom.dll
                                                                                          • Size 1.2MB
                                                                                          • SHA256 a2aa11458e3899bdc35f65d0eae838a96db7c6316c84ea914b2273a382ba8f8a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.General.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.General.dll
                                                                                          • Size 294KB
                                                                                          • SHA256 68329198e614b83bcad8303e4cbfdfe7045503613f3fb88620e7e308bdd9d33f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.LicenseActivationWizard.exe
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.LicenseActivationWizard.exe
                                                                                          • Size 174KB
                                                                                          • SHA256 466f8f419b32af7bae32077241439f395de194d385aa7d2919e6cd520e5065cc
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Locale.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Locale.dll
                                                                                          • Size 3.0MB
                                                                                          • SHA256 10216f69827f6400cb1789a09497c0a2b06b66385b6552708395324151c2856c
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Native.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Native.dll
                                                                                          • Size 1.2MB
                                                                                          • SHA256 f71de83892531a3524d10dc3649dded27d43620e873ea0fb72b4b91119262e78
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Render.Core.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Render.Core.dll
                                                                                          • Size 695KB
                                                                                          • SHA256 c7596d00abcda82516e46f32010dc30664a678fad066baed9683d00aeabd29d4
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Render.Data.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Render.Data.dll
                                                                                          • Size 357KB
                                                                                          • SHA256 7d554aa8d5472fc5c42b51b2eb8539f5cbad5e3d56c9aadc6d8c800fb2e71478
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Render.Util.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Render.Util.dll
                                                                                          • Size 5.3MB
                                                                                          • SHA256 026bad530772e52724a7506ab1880069aab3f106a350c0a27a6bd7d6bc795164
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Render.View.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Render.View.dll
                                                                                          • Size 1.2MB
                                                                                          • SHA256 1f17e0e867af0f626cfd581b1fd72798d0b6a979b924c3b720c148da45029318
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Support.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Support.dll
                                                                                          • Size 528KB
                                                                                          • SHA256 2b38fe80cd1d5168c4a816e5e789b831d6dbd187fa5fbdde4415e3a2f28f6f7b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.UI.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.UI.dll
                                                                                          • Size 303KB
                                                                                          • SHA256 0558d438ea5d1600b7c1e0fb37c7041a976b20e11a6d95c478a22a700932a634
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Web.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Web.dll
                                                                                          • Size 1.6MB
                                                                                          • SHA256 ced7cbe040e4ee34b8ab474f8838b10990fae7479bdd76e3e83bdf5a2f5a4597
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Workstation.exe
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\3mensio.Workstation.exe
                                                                                          • Size 185KB
                                                                                          • SHA256 817770b901eb649db336c206ad0c3742091859f7f8db39950fda185d2ad62e7f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Eula.pdf
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Eula\Eula.pdf
                                                                                          • Size 83KB
                                                                                          • SHA256 a185713a16e94aff21d0f7a50c1dc2e021ee32f9583de9bac4c09a961d2a2656
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Ijwhost.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Ijwhost.dll
                                                                                          • Size 148KB
                                                                                          • SHA256 8e5ff7b528dd19821496334c93d117242b98d3cecba45eaf153af721145c38dd
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Microsoft.Extensions.DependencyInjection.Abstractions.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Microsoft.Extensions.DependencyInjection.Abstractions.dll
                                                                                          • Size 42KB
                                                                                          • SHA256 9ccd830351aa28bc683d4f8d1cefd9e724161f972d25bfb64eee5bf55c48c5e3
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Microsoft.Extensions.DependencyInjection.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Microsoft.Extensions.DependencyInjection.dll
                                                                                          • Size 79KB
                                                                                          • SHA256 2aa8182b5356a8cc5c35fc3641a87e814857d8d9be399ac78f260343754d09e0
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Microsoft.Extensions.Logging.Abstractions.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Microsoft.Extensions.Logging.Abstractions.dll
                                                                                          • Size 60KB
                                                                                          • SHA256 d575c9d1543ca726ce14dbdffd103e93ea527cd46bb28316da1f4122dbc55d56
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Microsoft.Extensions.Logging.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Microsoft.Extensions.Logging.dll
                                                                                          • Size 43KB
                                                                                          • SHA256 183650081b551dfad967a7cbf79946a229cb79458b8d04a12db7c44b03bb9ab7
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Microsoft.Extensions.Options.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Microsoft.Extensions.Options.dll
                                                                                          • Size 57KB
                                                                                          • SHA256 786112cb2f6646ef1170219a8c0bb813c9f14a6781e67c6266414f55a679565d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Microsoft.Extensions.Primitives.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Microsoft.Extensions.Primitives.dll
                                                                                          • Size 39KB
                                                                                          • SHA256 8ce9a85927ec7507b11ffe90080e7a811d51304a9e8b1da20c350159ba403902
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Microsoft.WindowsAPICodePack.Shell.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Microsoft.WindowsAPICodePack.Shell.dll
                                                                                          • Size 529KB
                                                                                          • SHA256 7ce6ddd494e6cb7f37fbdba13e9875efd7490457862f3ff58e43ddb03066ec0a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Microsoft.WindowsAPICodePack.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Microsoft.WindowsAPICodePack.dll
                                                                                          • Size 103KB
                                                                                          • SHA256 79b4b5ef3aea64f37d0fd49fea8cebd4d93328e5557d4e48d096281cd82f4209
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Newtonsoft.Json.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\Newtonsoft.Json.dll
                                                                                          • Size 679KB
                                                                                          • SHA256 72cf291d4bab0edd08a9b07c6173e1e7ad1abb7ab727fd7044bf6305d7515661
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          SlimDX.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\SlimDX.dll
                                                                                          • Size 1.4MB
                                                                                          • SHA256 2629b3ccb62e58bdf811b5d444c3e87f0112b441f40029f8d57a1cedc4cd99e7
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          SlimMath.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\SlimMath.dll
                                                                                          • Size 87KB
                                                                                          • SHA256 f8a18ce79ffe8d7d110b861706608147587d54809b6005cccaf6f562255758ca
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          System.Management.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\System.Management.dll
                                                                                          • Size 287KB
                                                                                          • SHA256 6995bc11aa735e6772222e782eea80238663d11fbe577435310735ce0a197335
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          System.ServiceProcess.ServiceController.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\System.ServiceProcess.ServiceController.dll
                                                                                          • Size 60KB
                                                                                          • SHA256 68bb1c7a138878cb3a34f553cd93b3a165779fd59169cad9b95175b673844012
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          ThirdParty.Notices.html
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\ThirdParty.Notices.html
                                                                                          • Size 101KB
                                                                                          • SHA256 88ccad5bc1a79830c0823dbc6631cb698fe23a5d88b33b371b2ce1bedc87fbad
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          apidsp_windows_x64.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\apidsp_windows_x64.dll
                                                                                          • Size 272KB
                                                                                          • SHA256 e795e0716f36d5daef73b2d413e49845a29946d35d94b2c0b9a35ffa07c15e3a
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          concrt140.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\concrt140.dll
                                                                                          • Size 301KB
                                                                                          • SHA256 9fb6fadb1bb526e2da08417c656fa8c76377d19d94a7aa3cd88e66b68649871e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          d3dcsx_47.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\d3dcsx_47.dll
                                                                                          • Size 1.8MB
                                                                                          • SHA256 8eaf5ee3f8988b1769539e1ced344404d022e3ce01161a64db510cbcf0c6b833
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          hasp_net_windows.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\hasp_net_windows.dll
                                                                                          • Size 122KB
                                                                                          • SHA256 b91461e660b9b5a96513c88de14ce2d857d57cfd63bbf67e7537e2e68ccf7b6d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          hasp_rt.exe
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\hasp_rt.exe
                                                                                          • Size 3.1MB
                                                                                          • SHA256 7597302e597438f35450524f6ead3f5c31c4f0de355e4c6fcaa51718048bffb3
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          hasp_windows_x64_48834.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\hasp_windows_x64_48834.dll
                                                                                          • Size 5.6MB
                                                                                          • SHA256 8964aa77b4895df65d46daa89c468de850803c6b6be182bc8b500ececa2e89fb
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          haspvlib_48834.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\haspvlib_48834.dll
                                                                                          • Size 677KB
                                                                                          • SHA256 7e496c28cca80f733c078dce984c4cc895f3cf9a109ef0330c8c7b2022f72654
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          msvcp140.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\msvcp140.dll
                                                                                          • Size 571KB
                                                                                          • SHA256 10ddff48d704c6007e4c2d53fb4856b5e5e79479503366236246a323aaa76e9d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          msvcp140_1.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\msvcp140_1.dll
                                                                                          • Size 23KB
                                                                                          • SHA256 e10fb192620193cb721516c30533f71ca6b2a4396b48f3858b571143e94aba31
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          msvcp140_2.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\msvcp140_2.dll
                                                                                          • Size 181KB
                                                                                          • SHA256 046739d24a8253914ea8048e2c136cbba668e62fe5284cc0ff5db5f350b9da2c
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          msvcp140_atomic_wait.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\msvcp140_atomic_wait.dll
                                                                                          • Size 40KB
                                                                                          • SHA256 10e99480809ea56d13a477927ef7a36e866310117dfcfef5d73382f125349181
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          msvcp140_codecvt_ids.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\msvcp140_codecvt_ids.dll
                                                                                          • Size 19KB
                                                                                          • SHA256 a10cdbc9c42ec9829d0f54aa0adb75d0f990d40735eee5d8d6c0bf790019edcc
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          sntl_adminapi_net_windows.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\sntl_adminapi_net_windows.dll
                                                                                          • Size 38KB
                                                                                          • SHA256 da9373e37980fa40433db3c5a87cd5719ecd721337d2a08aafc748a721675a52
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          sntl_adminapi_windows_x64.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\sntl_adminapi_windows_x64.dll
                                                                                          • Size 361KB
                                                                                          • SHA256 00d01ccba2061a3ac48f53f8c8b42467607388434a732380de58f9c6467f0a8e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          vccorlib140.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\vccorlib140.dll
                                                                                          • Size 322KB
                                                                                          • SHA256 d79236e5ef69f842451fdb1a70c4c51295b01405972e943a624719219ea5f7e8
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          vcruntime140.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\vcruntime140.dll
                                                                                          • Size 91KB
                                                                                          • SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          vcruntime140_1.dll
                                                                                          • Path C:\Program Files\3mensio Medical Imaging\3mensio Workstation\vcruntime140_1.dll
                                                                                          • Size 35KB
                                                                                          • SHA256 f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          AdminSettings.xml
                                                                                          • Path C:\ProgramData\3mensio Medical Imaging\3mensio Workstation\10.4\Settings\AdminSettings.xml
                                                                                          • Size 508B
                                                                                          • SHA256 eb0beecdb8d948b06b9b010f73bf451feefe0fc486b967fa27f1772bcc7fe622
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          ArchiveSettings.xml
                                                                                          • Path C:\ProgramData\3mensio Medical Imaging\3mensio Workstation\10.4\Settings\ArchiveSettings.xml
                                                                                          • Size 1KB
                                                                                          • SHA256 8b2760942fb6dc54559b4ae28b24cc4874050987d0489977f1377981fdd7e54c
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          blocklist
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                          • Size 105KB
                                                                                          • SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 280B
                                                                                          • SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 280B
                                                                                          • SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          LOG.old
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                          • Size 558B
                                                                                          • SHA256 67502c1818d3c2d494de5ff9b41b32cf7509e4db9ca4b150cb73f6ceadbfca61
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          LOG.old
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                          • Size 331B
                                                                                          • SHA256 928e7b9171f2a766f1cf10ec17e09f4b708b80b6eac9325ff14b71f27478eea3
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          MANIFEST-000001
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                          • Size 158B
                                                                                          • SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          BookmarkMergedSurfaceOrdering
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                          • Size 6B
                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          f_0000ac
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
                                                                                          • Size 19KB
                                                                                          • SHA256 34578f9b38da85fdde2c2ae52143f00be3302ea894198ee844903a550f70985d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          f_0000af
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
                                                                                          • Size 59KB
                                                                                          • SHA256 4e8ea3db0f3d91fc36a2a0ff81968e6bb8608393ca9d4ff5aa808d8e1016ad86
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          f_0000b1
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
                                                                                          • Size 66KB
                                                                                          • SHA256 05fc189cbde39151f30a2c8d4a23a987e83f0c29e6057356f9a38e6ea69b1fb3
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          f_0000df
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000df
                                                                                          • Size 41KB
                                                                                          • SHA256 ea87b10595028b71472fc84d7604f0ffac1036d6a59c45f2879923eff332fbc7
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          f_0000ed
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ed
                                                                                          • Size 16KB
                                                                                          • SHA256 6fb27be59aba920a35ab6fc4fb3c1e81972fbc534cb2ffcd1b315ae0f41398c9
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          f_00011a
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011a
                                                                                          • Size 375KB
                                                                                          • SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          f_00011c
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011c
                                                                                          • Size 50KB
                                                                                          • SHA256 a23702aa5068bde18798ed1a4f1d8fa55041fc1ec134024b2b05af091d967473
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 71f25fffdd7cf0e6be5d224e4decc6126148aae32afda2b2b518fd2eef7a14fc
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 9KB
                                                                                          • SHA256 b2e2c8d4a5594ec6f423a24fa2bf7ff21b90093ae911ea37e5cb56d873191fa9
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 9KB
                                                                                          • SHA256 2e79a25100850d536a050827baa97a92f8f94b1bd27dc9ba0883174ab25be8d6
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index~RFe58e308.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e308.TMP
                                                                                          • Size 3KB
                                                                                          • SHA256 4aa3ee81215463d0036ac4d04385f839053604233c9f19b847614071bedda15e
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          SiteList-Enterprise.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                          • Size 2B
                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Edge Profile.ico
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                          • Size 70KB
                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          HubApps
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                          • Size 106KB
                                                                                          • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 111B
                                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 8KB
                                                                                          • SHA256 8ced84b0929a643027dd5ea3e5152f5dfd4dc390219253f1c13dec91da885364
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 14KB
                                                                                          • SHA256 d2b9477f94d4b22dce8b209b7aa3338c956745be7de1126431c5099f8896ce9b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                          • Size 13KB
                                                                                          • SHA256 7411c1f9ad0bcba361c3c881ef4733cd651ba9f1c7a6d9ae324d54b5d0c9d355
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          SCT Auditing Pending Reports
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                          • Size 2B
                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Sdch Dictionaries
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                          • Size 211B
                                                                                          • SHA256 9a19e8f1c5fc14a4faa42687b997b06f148ca53f69e7d05a5a4c9de1f5c7d9fe
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          Sdch Dictionaries~RFe59c068.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59c068.TMP
                                                                                          • Size 40B
                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 13KB
                                                                                          • SHA256 7ce27c4b13dcdc14bce4d6826934b01ba018723c6db5307faec91a2c0a36af12
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 20KB
                                                                                          • SHA256 cc05c8c22380969adfdc53ae5df2067a96477bb08dafe22d683bc14167bf4062
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 21KB
                                                                                          • SHA256 4b65e0b80b374b1563d37b489f44180c28b166d54669b8c94b07ab8924b6a2c7
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 13KB
                                                                                          • SHA256 0b5632ab12888063a49cb766fd2dfe681f4b01d8f4f2efb6601dfdfbb6134336
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 19KB
                                                                                          • SHA256 f8f00bb6ac3447c955f44e6f55a6411f9eded34770c34d8aad95dc060e424f9d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 36KB
                                                                                          • SHA256 ae72aaf98cd783828c3e9c959d9ffa6fd8a8df2c1959e868ecdc662c4c85b940
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 13KB
                                                                                          • SHA256 f9907c2121277811f2b94fcd024dbc8b799d6b4fbb9387dc203ad955e0784f56
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Secure Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                          • Size 30KB
                                                                                          • SHA256 1162b522eaf6c885fbb826a590627431d2cd357b62850fdfd4a51a390d1ebda1
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
                                                                                          • Size 3KB
                                                                                          • SHA256 020001c40d0a3839839b2169040bd4edc2758c0dc97b98f8dc4eec16b661e09f
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
                                                                                          • Size 2KB
                                                                                          • SHA256 636040a4698956615e6f2f33d33d55cc542f2828e88a54c01910301b8266f16b
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index~RFe593677.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe593677.TMP
                                                                                          • Size 2KB
                                                                                          • SHA256 b25e618abf60415e7af9a587f99e1bac974c651dc092e2760642f35148032aa7
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
                                                                                          • Size 72B
                                                                                          • SHA256 821d016424589c4003a9fc5dfb88b0ffe38c1506ac5d713a217034c4147ac60a
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
                                                                                          • Size 72B
                                                                                          • SHA256 ca47893e1174b6d3aa07114de010fa0937a402466fea4ab11fede2cfd4759b5b
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          index.txt
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                          • Size 371B
                                                                                          • SHA256 2c3c9c2ffc1082d452bb5d019144419952dcd2447f6ee9f3e5f581344897aae9
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          67a473248953641b_0
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
                                                                                          • Size 163KB
                                                                                          • SHA256 7147ab37c3f70ba2d4d59aa4085ed2a5b0465983e9d619a6ab9ffa6a417644cd
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          67a473248953641b_1
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
                                                                                          • Size 216KB
                                                                                          • SHA256 6cd90e29c2e6c32ec5ad368870004d3191270bbc36214048d58c673e1bce6350
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                          • Size 96B
                                                                                          • SHA256 2b545d596de60d0aab4bab0a308474fcf8cf9bbafd68625f4ca8f97b8cea27d7
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          the-real-index~RFe59e92d.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e92d.TMP
                                                                                          • Size 48B
                                                                                          • SHA256 3390209dd174a08a62b76a9ddd7c11e42d0fde4b89b6cdd825121abe0a58d87d
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          sync_diagnostic.log
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                          • Size 5KB
                                                                                          • SHA256 ae7b4885bcca26bd23779ea8486222da11dd8bd9f91a2559a8c065aad69ef532
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          2a9dee89-2c88-46a0-916e-506a5e7bf8fa.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2a9dee89-2c88-46a0-916e-506a5e7bf8fa.tmp
                                                                                          • Size 22KB
                                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 31f9cc798ca4b78766ed5280bba9dfd75008a9743113703ff2886f3d6d610d5b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 19KB
                                                                                          • SHA256 c50d4a9084cff9e83a4b6cfbde1651e8f3de5a6b1118d452255a3fcba1159968
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 a7c45b2aa1824017c1d781ea6bbbcf3f77a87f5b314c2072a366dc89508e4432
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 ac8328a7b627a5b2e68b9d1124f9d697c90fa727594c61778b5e8e7b92b973c6
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 919c8dcff409c1083810ab25d308cf5ae8abef3c9fb13341072ab35b0f67af72
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 4c84df0739df0c168fba527e78997260b2273294b2a35c0473bd109b49ff1983
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 8KB
                                                                                          • SHA256 e280e9ebf7b0dbd4415e99a8afa1a39c80a3e75df1f4110dba8b07911506a449
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 80a5d2b621c91e44208eeb59cc674323d7a8a91666cb307f45800e5a295c984f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 707641aa72be3709c879a6649d180c82c87871ec00d756d2355665c81b7f450e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 8KB
                                                                                          • SHA256 bb66775f36d8973ac5ecbbb45ffe716135aa8a456fbec506ddebe2ff55e8c899
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 19KB
                                                                                          • SHA256 04231a453bb4e165efa33a552ac619a1128668f4a907dea9128da8959ab82ca8
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 274892e738e6c7ad9ec1fd803b07fe6417bcfb2c79ac61df5fcfe6a8f57a93dd
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 9ca33602a4515bf31f2e4e9788609b35b2dcfe4d91d530e65934690e5906e19b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 68be4751fdca20e3f25ffdbaf631cf01d90a1b45f294668b3e38bc5159e51455
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 19KB
                                                                                          • SHA256 3855255ac03d5895b1eda8f86369c37f28161da7ddfe9522f0c6e21bcb1a7300
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 3af642a4fe215192fde5721610bb8624183ce454145e5f8722bc6e622c3874b1
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 27KB
                                                                                          • SHA256 98b69ad38b7ca941a1a00013dea6e487d539b15e5ec0a6b72376210af9a68afc
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          RevisitationBloomfilter
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                          • Size 392B
                                                                                          • SHA256 a85c43e07c1a80098eaf6521c3181e4b238227ddeaf21bf3ea647ba15da33334
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          RevisitationBloomfilter
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                          • Size 392B
                                                                                          • SHA256 4bde3897abd95d32840cefc62fa63b46488ea1c2dee4af51cc00611fa8ce1129
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          RevisitationBloomfilter
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                          • Size 392B
                                                                                          • SHA256 ac91e0f711c6535f503477250cd4de0b3e77c50489b5bd37d40791bd13ef3e3d
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          RevisitationBloomfilter~RFe59547f.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59547f.TMP
                                                                                          • Size 392B
                                                                                          • SHA256 4f25d3e2129ef814fcdfda3d484f84cb2e28f7a8733a7f191d3adc7d8467bdac
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          metadata.json
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                          • Size 13B
                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                          • Size 2KB
                                                                                          • SHA256 eff0ee5f149de70b39d20292cd7c3a45b9dba31f36f7160214fa40f19ece8a3d
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          iconcache_idx.db
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                          • Size 56KB
                                                                                          • SHA256 493c9d6f7823bb50b5cb49d53e94f77d4ae270fdfa45be105711a006af4e18a5
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          iconcache_idx.db
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                          • Size 56KB
                                                                                          • SHA256 642cd6a6c715a0a5ef711a42bd198a2fe9645f71ed4b04afb14838bd91447ccd
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          thumbcache_idx.db
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                          • Size 28KB
                                                                                          • SHA256 42d87f67728699c14599894baac8c91cd07adfa081877ac674bc29acb964e45c
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          SetupLauncher.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3mensio Workstation Setup\ASP.NET Runtime\SetupLauncher.exe
                                                                                          • Size 962KB
                                                                                          • SHA256 4b5698cc4ee9b1f25607339fa8e6a8effdbd27821750c539e68c83ab0cfa781f
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          aspnetcore-runtime-win-x64.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3mensio Workstation Setup\ASP.NET Runtime\aspnetcore-runtime-win-x64.exe
                                                                                          • Size 8.5MB
                                                                                          • SHA256 3ccad6d7f3cc1b334db1ab4d61de8a5252256b4ee75e53a9e054da25294af720
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Installer493x312.jpg
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5740\Installer493x312.jpg
                                                                                          • Size 49KB
                                                                                          • SHA256 fb1d988da6221dc74eb380a7c996336cde8d1e89bda3e56ea5a43d9724c87aac
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          Installer493x58.jpg
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5740\Installer493x58.jpg
                                                                                          • Size 21KB
                                                                                          • SHA256 595831d55697558360037177e65b0cd0b9778b91d5016a6009db5a127334d37b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          MSIFEBB.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MSIFEBB.tmp
                                                                                          • Size 550KB
                                                                                          • SHA256 140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          MSIFF2A.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MSIFF2A.tmp
                                                                                          • Size 927KB
                                                                                          • SHA256 b4c7b684ddceec5d4a809d8a7f4b8d2cf87e5b866e0d83f389018f423295ec4e
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          MSIFFB7.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MSIFFB7.tmp
                                                                                          • Size 632KB
                                                                                          • SHA256 3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          __PSScriptPolicyTest_c4ocdvcc.gla.ps1
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c4ocdvcc.gla.ps1
                                                                                          • Size 60B
                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          shi5BCF.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\shi5BCF.tmp
                                                                                          • Size 4.8MB
                                                                                          • SHA256 047e2df9ccf0ce298508ee7f0db0abcb2ff9cff9916b6e8a1fbd806b7a9d064b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          CheckDotNetVersion.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckDotNetVersion.exe
                                                                                          • Size 160KB
                                                                                          • SHA256 c27af0fd3b55c68a65b00273fb9281bb56632f8b980ea41f3fff6c2afc1b3b28
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          CheckSentinelVersion.exe
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\CheckSentinelVersion.exe
                                                                                          • Size 103KB
                                                                                          • SHA256 9f820ecb353dbf79bd6f7a4deb07802be97e50abbb90a40e5a98f0779edce13d
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Setup.msi
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\F725EE8\3mensio.Setup.msi
                                                                                          • Size 21.7MB
                                                                                          • SHA256 02578968d71507e31446948cc898a1b98226a0ada8239ace249ed14f6246862b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          3mensio.Workstation.runtimeconfig.json
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\F725EE8\3mensio.Workstation.runtimeconfig.json
                                                                                          • Size 372B
                                                                                          • SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                          Submit Download

                                                                                          decoder.dll
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Pie Medical Imaging B.V\3mensio Workstation\install\decoder.dll
                                                                                          • Size 215KB
                                                                                          • SHA256 0960f28f586617647f16ccb2ad9b38fba521605015a4c51f661d4bceca251db0
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          MSI8FC0.tmp
                                                                                          • Path C:\Windows\Installer\MSI8FC0.tmp
                                                                                          • Size 680KB
                                                                                          • SHA256 771b051df9dac27142ed38e72b0eec15749af8e130972a2b0e827426145add4b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          MSI9C75.tmp
                                                                                          • Path C:\Windows\Installer\MSI9C75.tmp
                                                                                          • Size 420KB
                                                                                          • SHA256 e41f6f894c56de7d87736311f162bad48f9aabd1bd029e03781cf1bc4946e468
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          MSIA2FE.tmp
                                                                                          • Path C:\Windows\Installer\MSIA2FE.tmp
                                                                                          • Size 330KB
                                                                                          • SHA256 ed82b8b5dc3641afffaba9e25b457a20323b5726de44132b63a5d6f4bdd07633
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          MSIA745.tmp
                                                                                          • Path C:\Windows\Installer\MSIA745.tmp
                                                                                          • Size 420KB
                                                                                          • SHA256 01c9d9097f80900383e67ba7f2e7ee59ad32b35e0cf4c02e7a1cae698fa72de1
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          MSIBE1E.tmp
                                                                                          • Path C:\Windows\Installer\MSIBE1E.tmp
                                                                                          • Size 618KB
                                                                                          • SHA256 abd77470133fb4e75549027de81b051b61dd68d55a6b2424c5d541d8eaec5605
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          e5d2ab0.msi
                                                                                          • Path C:\Windows\Installer\e5d2ab0.msi
                                                                                          • Size 8.3MB
                                                                                          • SHA256 51309696cab19ef5f5637af31616a15e2b2be1bc8333daaa69fd46dd3466a9fd
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          logo.png
                                                                                          • Path C:\Windows\Temp\{71F6C91D-6550-4362-A964-74DCC4C98C78}\.ba\logo.png
                                                                                          • Size 12KB
                                                                                          • SHA256 c8e23a42e04fbd73f5f66f3b9f2ba34a777bc4769c413a0f78335a4e757baad5
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          wixstdba.dll
                                                                                          • Path C:\Windows\Temp\{71F6C91D-6550-4362-A964-74DCC4C98C78}\.ba\wixstdba.dll
                                                                                          • Size 197KB
                                                                                          • SHA256 41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          aspnetcore-runtime-win-x64.exe
                                                                                          • Path C:\Windows\Temp\{7575C594-C4D6-4B0C-9719-E3AC7949593B}\.cr\aspnetcore-runtime-win-x64.exe
                                                                                          • Size 593KB
                                                                                          • SHA256 22bc1b912d7bbd56957b91e2d7e38eeff24b389e21f766ee59524b7787bdcec9
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          thm.wxl
                                                                                          • Path C:\Windows\Temp\{D73F01A1-00EA-4F9F-8CA3-94C38336BF42}\.ba\thm.wxl
                                                                                          • Size 4KB
                                                                                          • SHA256 6f8aefc6ae2196041af4b6f19fa266f8197d2657e1031de3399a2792ba74b74b
                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                          Submit Download

                                                                                          _test.tmp
                                                                                          • Path F:\3mensio Archive\Images\_test.tmp
                                                                                          • Size 1B
                                                                                          • SHA256 2a0ab732b4e9d85ef7dc25303b64ab527c25a4d77815ebb579f396ec6caccad3
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          memory/980-2875-0x0000000006850000-0x000000000689C000-memory.dmp
                                                                                          Download

                                                                                          memory/980-2867-0x0000000005C80000-0x0000000005FD4000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2260-0x00000000054D0000-0x00000000054F2000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2273-0x0000000007BE0000-0x000000000825A000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2274-0x00000000069C0000-0x00000000069DA000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2275-0x0000000007760000-0x00000000077F6000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2276-0x0000000007440000-0x0000000007462000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2277-0x0000000008810000-0x0000000008DB4000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2272-0x00000000064A0000-0x00000000064EC000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2271-0x0000000006470000-0x000000000648E000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2261-0x0000000005DD0000-0x0000000005E36000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2259-0x0000000005670000-0x0000000005C98000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2258-0x0000000002EB0000-0x0000000002EE6000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2270-0x00000000060A0000-0x00000000063F4000-memory.dmp
                                                                                          Download

                                                                                          memory/4008-2264-0x0000000005E40000-0x0000000005EA6000-memory.dmp
                                                                                          Download