modiloader | 1d6edd6097443e7d6db8005137ce72046c9a3bfbe10c4768eaa005897dc72fa3

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2025, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe
Size

15.5MB
MD5

0fe46df7313b28cee5a7fb6a6fdc44ed
SHA1

509b0689befd9a871da492caf64d123805553e74
SHA256

1d6edd6097443e7d6db8005137ce72046c9a3bfbe10c4768eaa005897dc72fa3
SHA512

4ff0e210bec1328138866991cc3403fd126f14994dd60dd1d848c34f624bd1898c05335220ad32d92d95b90be36cc7b3f795c09cb9af3a121eae9c3c3484a0c4
SSDEEP

393216:P5QrlPyQaqjO5nWPqcXNNQPaknbJoc+Y:yhPA8Gn5YQPakbKO

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe

Executes dropped EXE 1 IoCs

pid	Process
4116	MsManager.exe

Loads dropped DLL 4 IoCs

pid	Process
4192	MsiExec.exe
4192	MsiExec.exe
2908	MsiExec.exe
2908	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File created	C:\Windows\System32\Resources\1033\DTSRUN.rll	cmd.exe
File created	C:\Windows\System32\sqlunirl.dll	cmd.exe
File created	C:\Windows\System32\Resources\1049\dtsffile.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1049\dtsffile.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1033\dtsffile.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1033\dtspkg.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1033\axscphst.RLL	cmd.exe
File opened for modification	C:\Windows\System32\sqlunirl.dll	cmd.exe
File created	C:\Windows\System32\custtask.RLL	cmd.exe
File created	C:\Windows\System32\dtspump.DLL	cmd.exe
File created	C:\Windows\System32\Resources\1049\DTSRUN.rll	cmd.exe
File created	C:\Windows\System32\sqlresld.DLL	cmd.exe
File created	C:\Windows\System32\dtsffile.DLL	cmd.exe
File opened for modification	C:\Windows\System32\dtsffile.DLL	cmd.exe
File created	C:\Windows\System32\Resources\1049\custtask.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1049\custtask.RLL	cmd.exe
File created	C:\Windows\System32\Resources\1049\dtspump.RLL	cmd.exe
File created	C:\Windows\System32\Resources\1033\dtspkg.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1033\DTSRUN.rll	cmd.exe
File opened for modification	C:\Windows\System32\custtask.RLL	cmd.exe
File opened for modification	C:\Windows\System32\dtspkg.DLL	cmd.exe
File opened for modification	C:\Windows\System32\axscphst.DLL	cmd.exe
File created	C:\Windows\System32\Resources\1033\dtspump.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1049\axscphst.RLL	cmd.exe
File created	C:\Windows\System32\Resources\1049\dtspkg.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1049\DTSRUN.rll	cmd.exe
File created	C:\Windows\System32\Resources\1033\dtsffile.RLL	cmd.exe
File opened for modification	C:\Windows\System32\custtask.DLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1049\dtspkg.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1049\dtspump.RLL	cmd.exe
File created	C:\Windows\System32\Resources\1033\axscphst.RLL	cmd.exe
File created	C:\Windows\System32\Resources\1033\custtask.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1033\dtspump.RLL	cmd.exe
File created	C:\Windows\System32\dtspkg.DLL	cmd.exe
File opened for modification	C:\Windows\System32\dtspump.DLL	cmd.exe
File created	C:\Windows\System32\custtask.DLL	cmd.exe
File created	C:\Windows\System32\axscphst.DLL	cmd.exe
File opened for modification	C:\Windows\System32\sqlresld.DLL	cmd.exe
File created	C:\Windows\System32\Resources\1049\axscphst.RLL	cmd.exe
File opened for modification	C:\Windows\System32\Resources\1033\custtask.RLL	cmd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\XMLSchemaColls.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtspkg.DLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Synonyms.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Triggers.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\SynonymsLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\PartitionSchemesLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Templates\runtemplates.bat	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\DDLTriggers.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Templates\templates.reg	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Languages\russian.lng	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2428_1776689785\manifest.json	msedge.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\msmanager.chm	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Schemas.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\AssembliesLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\RulesLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Defaults.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\UDTsLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\RolesLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\SchemasLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\sqlresld.DLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\DTSRUN.rll	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\regdts.bat	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\UsersLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Rules.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Languages\german.lng	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\PartitionSchemes.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtspkg.RLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtsffile.RLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\axscphst.RLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Assemblies.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\IndicesLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Tables.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\MsManager.exe	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtspump.DLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\UDTs.frf	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2428_1454007192\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS5E2165DB765A45AFBB1C9CE3C25588DA_2_4_0_1.MSI	2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtsffile.DLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Users.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Roles.frf	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2428_1776689785\manifest.fingerprint	msedge.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\PartitionFunctions.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\MsManager.tps	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Procedures.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\DDLTriggersLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\ViewsLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\UDFsLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\PartitionFunctionsLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Languages\italian.lng	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\news.inf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtspump.RLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\DTSRUN.exe	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\ProceduresLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Fruser.hlp	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2428_1454007192\manifest.fingerprint	msedge.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Aggregates.frf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS5E2165DB765A45AFBB1C9CE3C25588DA_2_4_0_1.MSI	2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\license.txt	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\custtask.RLL	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\TriggersLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\Indices.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Reports\DefaultsLt.frf	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Languages\english.lng	msiexec.exe
File created	C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\sqlunirl.dll	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e589121.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE6C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58911f.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6A8.tmp	msiexec.exe
File created	C:\Windows\Installer\e58911f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5E2165DB-765A-45AF-BB1C-9CE3C25588DA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9390.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c0ba7f28baba6d450000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c0ba7f280000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c0ba7f28000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc0ba7f28000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c0ba7f2800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133879424052615903"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10010207-740B-11D0-AE7B-00AA004A34D5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020205-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020907-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020908-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\ = "{10010001-EB1C-11CF-AE6E-00AA004A34D5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020914-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020910-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1002090C-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10030101-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10030101-EB1C-11CF-AE6E-00AA004A34D5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10030310-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10030701-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\Version = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020906-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10021105-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10010902-740B-11D0-AE7B-00AA004A34D5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10010B02-740B-11D0-AE7B-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10010207-740B-11D0-AE7B-00AA004A34D5}\TypeLib\ = "{10010200-740B-11D0-AE7B-00AA004A34D5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CF1988D2-E143-11D2-AB67-00C04F79EE8C}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10010208-740B-11D0-AE7B-00AA004A34D5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10010B02-740B-11D0-AE7B-00AA004A34D5}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10010202-740B-11D0-AE7B-00AA004A34D5}\TypeLib\ = "{10010200-740B-11D0-AE7B-00AA004A34D5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020A07-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10010205-740B-11D0-AE7B-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10030701-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020207-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020E07-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10010207-740B-11D0-AE7B-00AA004A34D5}\ = "DTSTransformPhaseInfo"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020904-EB1C-11CF-AE6E-00AA004A34D5}\ = "CustomTask"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020905-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020914-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{96501C2B-E633-11D2-ACED-00C04F689068}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1002090F-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\ = "{10010001-EB1C-11CF-AE6E-00AA004A34D5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1002090E-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\ = "{10010001-EB1C-11CF-AE6E-00AA004A34D5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10022005-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10030A01-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96501C2B-E633-11D2-ACED-00C04F689068}\TypeLib\ = "{6FD930BF-FCBE-11D2-AB6E-00C04F79EE8C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020305-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020305-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020B06-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0AED9960-FCFB-11D2-ACF5-00C04F689068}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020A08-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\ = "{10010001-EB1C-11CF-AE6E-00AA004A34D5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD5612E5A567FA54BBC1C93E2C5588AD\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1002090F-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\Version = "2.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020B05-EB1C-11CF-AE6E-00AA004A34D5}\ = "PrecedenceConstraints"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020D07-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\Version = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020E07-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7EFF0BDC-E3C3-11D2-AB67-00C04F79EE8C}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-869607583-2483572573-2297019986-1000\{BAF34E5A-B231-4419-9B06-E72389D267BE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1002090B-EB1C-11CF-AE6E-00AA004A34D5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10010004-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\ = "{10010001-EB1C-11CF-AE6E-00AA004A34D5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020B06-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10021005-EB1C-11CF-AE6E-00AA004A34D5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7CA08F2-FCFA-11D2-ACF5-00C04F689068}\ = "DTSMQMessage"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10030610-EB1C-11CF-AE6E-00AA004A34D5}\ = "PackageInfo"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020706-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020B06-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020911-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10030001-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10030210-EB1C-11CF-AE6E-00AA004A34D5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10020C07-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10030210-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib\ = "{10010001-EB1C-11CF-AE6E-00AA004A34D5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10030710-EB1C-11CF-AE6E-00AA004A34D5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10030610-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10020F05-EB1C-11CF-AE6E-00AA004A34D5}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10030101-EB1C-11CF-AE6E-00AA004A34D5}\ProxyStubClsid	msiexec.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2616	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1484	msiexec.exe
1484	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	376	msiexec.exe
Token: SeIncreaseQuotaPrivilege	376	msiexec.exe
Token: SeSecurityPrivilege	1484	msiexec.exe
Token: SeCreateTokenPrivilege	376	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	376	msiexec.exe
Token: SeLockMemoryPrivilege	376	msiexec.exe
Token: SeIncreaseQuotaPrivilege	376	msiexec.exe
Token: SeMachineAccountPrivilege	376	msiexec.exe
Token: SeTcbPrivilege	376	msiexec.exe
Token: SeSecurityPrivilege	376	msiexec.exe
Token: SeTakeOwnershipPrivilege	376	msiexec.exe
Token: SeLoadDriverPrivilege	376	msiexec.exe
Token: SeSystemProfilePrivilege	376	msiexec.exe
Token: SeSystemtimePrivilege	376	msiexec.exe
Token: SeProfSingleProcessPrivilege	376	msiexec.exe
Token: SeIncBasePriorityPrivilege	376	msiexec.exe
Token: SeCreatePagefilePrivilege	376	msiexec.exe
Token: SeCreatePermanentPrivilege	376	msiexec.exe
Token: SeBackupPrivilege	376	msiexec.exe
Token: SeRestorePrivilege	376	msiexec.exe
Token: SeShutdownPrivilege	376	msiexec.exe
Token: SeDebugPrivilege	376	msiexec.exe
Token: SeAuditPrivilege	376	msiexec.exe
Token: SeSystemEnvironmentPrivilege	376	msiexec.exe
Token: SeChangeNotifyPrivilege	376	msiexec.exe
Token: SeRemoteShutdownPrivilege	376	msiexec.exe
Token: SeUndockPrivilege	376	msiexec.exe
Token: SeSyncAgentPrivilege	376	msiexec.exe
Token: SeEnableDelegationPrivilege	376	msiexec.exe
Token: SeManageVolumePrivilege	376	msiexec.exe
Token: SeImpersonatePrivilege	376	msiexec.exe
Token: SeCreateGlobalPrivilege	376	msiexec.exe
Token: SeCreateTokenPrivilege	376	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	376	msiexec.exe
Token: SeLockMemoryPrivilege	376	msiexec.exe
Token: SeIncreaseQuotaPrivilege	376	msiexec.exe
Token: SeMachineAccountPrivilege	376	msiexec.exe
Token: SeTcbPrivilege	376	msiexec.exe
Token: SeSecurityPrivilege	376	msiexec.exe
Token: SeTakeOwnershipPrivilege	376	msiexec.exe
Token: SeLoadDriverPrivilege	376	msiexec.exe
Token: SeSystemProfilePrivilege	376	msiexec.exe
Token: SeSystemtimePrivilege	376	msiexec.exe
Token: SeProfSingleProcessPrivilege	376	msiexec.exe
Token: SeIncBasePriorityPrivilege	376	msiexec.exe
Token: SeCreatePagefilePrivilege	376	msiexec.exe
Token: SeCreatePermanentPrivilege	376	msiexec.exe
Token: SeBackupPrivilege	376	msiexec.exe
Token: SeRestorePrivilege	376	msiexec.exe
Token: SeShutdownPrivilege	376	msiexec.exe
Token: SeDebugPrivilege	376	msiexec.exe
Token: SeAuditPrivilege	376	msiexec.exe
Token: SeSystemEnvironmentPrivilege	376	msiexec.exe
Token: SeChangeNotifyPrivilege	376	msiexec.exe
Token: SeRemoteShutdownPrivilege	376	msiexec.exe
Token: SeUndockPrivilege	376	msiexec.exe
Token: SeSyncAgentPrivilege	376	msiexec.exe
Token: SeEnableDelegationPrivilege	376	msiexec.exe
Token: SeManageVolumePrivilege	376	msiexec.exe
Token: SeImpersonatePrivilege	376	msiexec.exe
Token: SeCreateGlobalPrivilege	376	msiexec.exe
Token: SeCreateTokenPrivilege	376	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	376	msiexec.exe
Token: SeLockMemoryPrivilege	376	msiexec.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
376	msiexec.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
376	msiexec.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4116	MsManager.exe
4116	MsManager.exe
4116	MsManager.exe
4116	MsManager.exe
4116	MsManager.exe
4116	MsManager.exe
4116	MsManager.exe
4116	MsManager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 376	2612	2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe	88
PID 2612 wrote to memory of 376	2612	2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe	88
PID 2612 wrote to memory of 376	2612	2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe	88
PID 1484 wrote to memory of 4192	1484	msiexec.exe	92
PID 1484 wrote to memory of 4192	1484	msiexec.exe	92
PID 1484 wrote to memory of 4192	1484	msiexec.exe	92
PID 1484 wrote to memory of 2868	1484	msiexec.exe	113
PID 1484 wrote to memory of 2868	1484	msiexec.exe	113
PID 1484 wrote to memory of 2908	1484	msiexec.exe	116
PID 1484 wrote to memory of 2908	1484	msiexec.exe	116
PID 1484 wrote to memory of 2908	1484	msiexec.exe	116
PID 2908 wrote to memory of 2428	2908	MsiExec.exe	117
PID 2908 wrote to memory of 2428	2908	MsiExec.exe	117
PID 1484 wrote to memory of 4116	1484	msiexec.exe	118
PID 1484 wrote to memory of 4116	1484	msiexec.exe	118
PID 1484 wrote to memory of 4116	1484	msiexec.exe	118
PID 1484 wrote to memory of 5000	1484	msiexec.exe	119
PID 1484 wrote to memory of 5000	1484	msiexec.exe	119
PID 2428 wrote to memory of 748	2428	msedge.exe	121
PID 2428 wrote to memory of 748	2428	msedge.exe	121
PID 2428 wrote to memory of 4576	2428	msedge.exe	122
PID 2428 wrote to memory of 4576	2428	msedge.exe	122
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123
PID 2428 wrote to memory of 3028	2428	msedge.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS5E2165DB765A45AFBB1C9CE3C25588DA_2_4_0_1.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2025-04-01_0fe46df7313b28cee5a7fb6a6fdc44ed_amadey_smoke-loader.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:376

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5B977D5B58D18329B9B5D60D6BF8F29B C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4192
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2868
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 061B0BE5A56D666151F3CF61154BBFC4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mssqlmanager.com/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x360,0x7ffe8a56f208,0x7ffe8a56f214,0x7ffe8a56f220
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1712,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2228,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1952,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4068,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4084,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3868,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:8
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5228,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4692,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4676,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5868,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5992,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3948,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5900,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5900,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6636,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3988,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6660,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6996,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7140,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6832,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:8
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=120,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5968,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
      4⤵
      PID:512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5468,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6168,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5460,i,2367942523427450817,2432191498048665128,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      PID:4876
- C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\MsManager.exe
  "C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\MsManager.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4116
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EMS\\SQL Manager 2005 for SQL Server\DTSRedist\regdts.bat" "C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist""
  2⤵
  - Drops file in System32 directory
  PID:5000
- - C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Windows\System32\dtsffile.dll
    3⤵
    PID:6084
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Windows\System32\dtsffile.dll
      4⤵
      System Location Discovery: System Language Discovery
      PID:6104
- - C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Windows\System32\dtspkg.dll
    3⤵
    PID:5496
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Windows\System32\dtspkg.dll
      4⤵
      System Location Discovery: System Language Discovery
      PID:5540
- - C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Windows\System32\dtspump.dll
    3⤵
    PID:5892
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Windows\System32\dtspump.dll
      4⤵
      System Location Discovery: System Language Discovery
      PID:5912
- - C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Windows\System32\axscphst.dll
    3⤵
    PID:6108
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Windows\System32\axscphst.dll
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EMS\\SQL Manager 2005 for SQL Server\Templates\runtemplates.bat" "C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Templates\templates.reg""
  2⤵
  PID:5528
- - C:\Windows\regedit.exe
    regedit /S "C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Templates\templates.reg"
    3⤵
    - Runs .reg file with regedit
    PID:2616

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5944

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x2f4
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e589120.rbs

Filesize
87KB

MD5
4cda0665bae7746b94b72c34719bb3b8

SHA1
d17d00e79e0bf9e46b158dfec7fdc847354a4094

SHA256
178a7f96a6af28003bc7e8ba6e0c3b6d2d3eb116e4cbad78881e80e4ffac2c85

SHA512
2243516dcf45143490814ae3e7014c13cf12c807acd03b902c4a7113f83ab8ca85bc512df08238810e8284c31bbe602683407ebed08ed87cf10ac2dae3afdc3c

Download Submit
C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS5E2165DB765A45AFBB1C9CE3C25588DA_2_4_0_1.MSI

Filesize
15.4MB

MD5
116720aa43a75812aa14a5eff4e4b3cf

SHA1
98c1027ee67c7d707c5d9919ae2e6fce4cf4d959

SHA256
389be2c3cc28c09ecd741642a5448c877ca0ebdc3030f663d0a89f610329dd46

SHA512
13fa4b7d1f453ececc15651ce25e2d6487fd9c9c14ce3c8d0048c7ff4741ecc98c78569ceed04ca3c392b42c784bbe23495e6f859c8f37d96812737199ade6c7

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\DTSRUN.rll

Filesize
24KB

MD5
0f3011f432aa10a81e293d05736f05b8

SHA1
91589ef355caee1d9df6d2572b49ebe818d738ef

SHA256
1a315c592ad12c56baed4d395c1c208ddcb4b5ef7047a3e23b6e585503156542

SHA512
97978b33d48bc68482e11941f7eaa049322d30515449ef6350318b40da23ee14722db8584294e2ebdb77bdcb23e3aafe01f00f24677acc352a98912187b8302a

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\axscphst.DLL

Filesize
56KB

MD5
4b269f7d9c710cbcc827a53076673d9c

SHA1
bde6b3c06d5c99860e6cc785a22164ec26ceeaa0

SHA256
88e1d4a51bdf9fd336a528c888e5080deac360c5b1c43549c498978f03193bbc

SHA512
d99d3fcc74105c4baa52ef70a51f5330b88a782670400476c0eb7796580bbaeda7164ff3fd55544b36e5e9c531c7f8c6e7f2c30233b0bb418c34d9d6d499d78f

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\axscphst.RLL

Filesize
28KB

MD5
9656913bbd46aeb6f342b9218351db15

SHA1
ed1d52f03c93e9bb91d3db7e5a556b8eeed225c3

SHA256
7dce9a67717bd07529dcc2335d8865b1b377eeb660d054387c4fff21a305e915

SHA512
9542c2e1a4b8e41ed740831589968ea3b106eb85739f8cabab783617083f9bb20ca1633fbec30f2a89b132dd82b4eba1d91526f64c50bc75e31e8ccb052b1c22

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\custtask.DLL

Filesize
308KB

MD5
9cbc3474b1d327fa82089d58a2808565

SHA1
5fbaafc261c02c8f1d6ff84fb474ed60b6827728

SHA256
6f2ea6125f395a4f4a8f4ba31dbf000ae20e73a0163296e4876df7beff149a2a

SHA512
fd8ae30973b7e924659cdcaf17ac22b62e973515d1e40eee049631f412f31ce4f3138c4595200e356a1e3a43d73ed00af5d72a3015d4e2463eb3ece289e08e39

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\custtask.RLL

Filesize
64KB

MD5
9f3ab09c761f6d58aaec277f4b01c64c

SHA1
9bce779f1a98cec530525348becb7972a707e6c8

SHA256
a9133559793bb9633479bafb07196831a8da3f4a17415f1e035e86c92e35821a

SHA512
e6e31a42df77594a5cbaba4b1a89f2cf39c9e47e9c8d23c144b3a2c805cbd6bd18900c045351e9dd7fd5c8883c1d49590e0aebe2d5cc80797dd16b645525963b

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtsffile.DLL

Filesize
116KB

MD5
34eff0305ef99fb1e2f8de2f74fa67c1

SHA1
22d6cf40509e705e04dc7f58cc7f4979b9574513

SHA256
a4ef47473e1fc3395ff618795c3f2f231b93fa133cf1e244df8c59c136009fce

SHA512
6817826f39122b8f06b4064578b75a44a0848b955f1d1c3458b2ac812e77547586476f606dd7bd21dc977e6492bf7d4eaceda3ba680fabac9cee58eaee9891a3

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtsffile.RLL

Filesize
28KB

MD5
1b9101928a2f5bed66f919f1e3367585

SHA1
5de54b61d37fb756c8981f238338bbe8aa6a38de

SHA256
779c37eacb76e4bcb865a77ca6325e0573aeed7cff86b9c130fb36c4bd0b0820

SHA512
c2e18b4de0ab7d9ea54f6847da212dca706c87fc621e9a416b9e36c35ab050d924d6eb70d8da9e334f6fa8b9c2f80de8795c5db461b5ef484e643d8c6e182d8f

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtspkg.DLL

Filesize
1.8MB

MD5
2c0fea8aec9564afff63c4c85f5062f8

SHA1
9e8c617c537a1b05da849ca95ec2c7fa77b61420

SHA256
ba792fb78084dd4ec5c171c6bf62e555fac9d6d64dd162ac0f7bcd99232e085a

SHA512
7bd10b7fc267f960de1a299d4d226a329f324a5d03c100805d6670a266528fa05bce88c48501a4528eea22513e3648f3a486e21dc36872629b096a472db099be

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtspkg.RLL

Filesize
204KB

MD5
85a7e53507e462a6e2d58b8635d25e43

SHA1
38a04a1d61a18bf808cbbf4b4d6ed9cfdaab298d

SHA256
21be5a0d2f23ae9e60b4dae7a898b52098bb979f2ca4d333d3f0868012bb911d

SHA512
e84d74b2389ecb679db4726043549b1c43980b5f68071ed6323fe7bb76a48577c6cbc0571ffe2a6ba9c74f93b038e08e65897aecba56a6a7282a2f5ee50c7d60

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtspump.DLL

Filesize
516KB

MD5
14ae21e482995a7990e1c7214e31a518

SHA1
491bbcce3a33dd600ed71a01b39dc52938951bbf

SHA256
5a3432fa1d18e86aed10df213d521d968842b81181d8a9ac7c9999826b998ba4

SHA512
55f3dd5bf00e28a57d9262679aef89e43154957c76f9e604f29449752c658616cf87fffd288ac71ba7af79ea7329741d83529e82f19cac951b1c2c6fee16c24d

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\dtspump.RLL

Filesize
100KB

MD5
2a25d3ee683dc007c13da807f5c7e3ab

SHA1
948bb322e1daf2211a259b8487a40705021edcc1

SHA256
1b6db4323274b861dd310a29dc379fe2291a8bb953eeccec4dfde74f46e6bf1b

SHA512
28ff84a07ac5f73ac0f1377aa7b466052c0d17737f230e3e16636b3bd659a82e356b8005092cf5679ec1cae891a1facdab9d0fc1f061083fe431fb64227a1110

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\regdts.bat

Filesize
1KB

MD5
13e2b7499e71ae7e7e94fb639ce890d7

SHA1
b002b415e239921fb54fdbfa2b22a76c1c1ac3e7

SHA256
9cfc372f0627e3206b8e0b40ec62b7924ee5e419e6e53e8b48fc51ce7bd47e57

SHA512
9dcddccd9121c6b19a10a3e4a8e39313d422c854ad84be2a386d8e403d1acfd6a3eb44770066cd00b546990e0bbf37b6eb5b50d9aa9fb2530eef39fb97c22bb4

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\sqlresld.DLL

Filesize
28KB

MD5
9bce545be9bb87bd10a82221f0e72e2c

SHA1
ad6ec8dd1e68ce47d30a1c12e4a31ba901b87504

SHA256
affada9a776429364331164e55ff343675e3694ed6538a176f5a3b48f9757e27

SHA512
e27086cb878ea99d4a6bde55b57e631418b670459fdd4d28d86b5302374ffb99b9d1237119a15aa2016d06b39f36837504663812f74d3c78e1f7a102c0ad3f5c

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\DTSRedist\sqlunirl.dll

Filesize
176KB

MD5
586fb648625327fea66dcbf3eeefd355

SHA1
57ee4f1da3c145a2689612647090064fa0a06c35

SHA256
8696c01224d1d5c3aae3e4ac6d77db5254fcfb3ff71e3a59f6198c392b0d68f4

SHA512
754af6ea48bbed6103d076b86126aa9db1fc2056b40798dd0be56c3c10cf9ae7c4b86bf3dadf04fdd28ddd2dccfbe76a8e9fbe9775443e612483e7ea5df3c932

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Languages\english.lng

Filesize
352KB

MD5
0abad700a3132c5ba762201b19318d00

SHA1
d4a2428940fc20e6750876239b2456f681c31346

SHA256
84b610cf7315bb86772343927d096bb9092b754af63242269f290c5951802046

SHA512
313a9faff4f1df9540d1c2b10f6bcaf7ac101921242a02f7ef6e3bb2399315b20371c26e68b72ece36cfb8624cd601edd0c84672cee0eb07af86056d9cf2afb5

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Languages\german.lng

Filesize
389KB

MD5
1d71dd144a7b1d593223dd194890750d

SHA1
328ff35595a7fcecbab03dc24972a8803b785963

SHA256
345533ede7f53dc22a1132366f41dbec966726551a5749c0a6a0e140ed78a09e

SHA512
9430b4fb923a3862f8ac6be7e54174d116ac3f545e125df19c76a2f5f2821654470685b019eb09908779a23d527e74608b0ff518323478d53eac0a5501e8815f

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Languages\italian.lng

Filesize
334KB

MD5
379843bf8e05b660d37f5bec391b333c

SHA1
2918efb5cf396ce9377a77894943b01510bc23e9

SHA256
69a3e0b6b44bc2ef124f8cf80d18e6036fa52cc0b96c58dd9524ac7ebd601af8

SHA512
9d8a68ef5e08c09eedf1292f2f1b1d02a2ebbcde1b8c88fa28fc728bcf076136004d8011d7a54ad85859047dfd4949661e63b544e068e331a65dcab9a171d0ce

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Languages\russian.lng

Filesize
374KB

MD5
ff117bffc0cff5471c388d9e7f1dc226

SHA1
2d016295807c189bcb35218a8db01f3b258056e9

SHA256
de3aba5a9153a308f56b619593dae15c957324d0df42a6308e8cba33e485b87a

SHA512
5986b4f43f0d6275f04994a0b6fd0478a595eb9a771339f46f81f7f7ea4f4881c2ba8a339efc124a423287e68fc58f188eee1575afaed8b9f75ec78978c74113

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\MsManager.exe

Filesize
3.8MB

MD5
deb7223e7b481574c9d5e0ccaa873c80

SHA1
39dc334a5d1d8b4cd13c73ad40b37c62adf738fa

SHA256
bdb92dadbfde7fead267fe8f617c9e5dbb5e53695ad480ec8c1784f2eb8a4b86

SHA512
c2667f62816e9605a9b1a4cb2d3307f878acddf1b3f85ad90387a6f50203e29913c8f5aac38135a4ed8f3484004c6ab29b26cd0bed9d4f7adaba218d19df9d45

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\MsManager.tps

Filesize
1KB

MD5
770d3b7b3eaf824ad281b079c2730377

SHA1
5f4d07dea135bec7c58430a913f31bcf40ad542d

SHA256
84b32ba372ad7b700a4f242b7c6e3f8c254418f2e34572bebb7f183e4301ff6e

SHA512
408355e7ee74496f684b25bcf7f3d35aac5ae8fe7b99982fbcb5b939d5b0019884e678a10a3a49bda6b6ac853048446f1538ed6d9b7a9fb204afebdb96399d06

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Templates\runtemplates.bat

Filesize
157B

MD5
37c2923166caef96ddcd95e06cc54a81

SHA1
349914716bdb8b78aec25bf6fd49a90741a6c563

SHA256
b1c11b5fe3d8c815d663885258ae8db6a93a107d03801ad9ad2bd0f0e3714840

SHA512
9267c06e0e63903caf0ee1792fe81a652d443af864354dc0f7c5c563285e309e07368e059de90819f3543d8220767777c5cb22a16f4395edf8a1714ccfae5a38

Download Submit
C:\Program Files (x86)\EMS\SQL Manager 2005 for SQL Server\Templates\templates.reg

Filesize
2KB

MD5
1f140e834044fd4bb64981ebb6dabc17

SHA1
ab01b6f1ed341c164ad1f4eca32fd354b898cbd1

SHA256
6c38766206350fdd452ec2763687d4172a6bbe3a94d1a5c64f06be16967fab32

SHA512
965e8a4be2bfa06f761d8869035dc746ca3aa06668793b716280150a917d45a4edb5f2b5bbd2af349ddbd28c114b3fe6842a9d98f9737d41628020932c1654cc

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2428_1776689785\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
049e5a246ed025dee243db0ba8e2984c

SHA1
15ec2d2b28dcfc17c1cfb5d0c13482d0706f942d

SHA256
33071ca42c472861a2fabd0f82f8b03ef0daaa6796b24b83f3df02587e4c3d12

SHA512
bc5f6fa6a8cae20ab40eae4552650d75f38ebb158c95288a79d9f332623bb507946513c39d19c00a5aee323df01f0f1a51c54594ef1c293289baf45f4ae2145b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4facd0ff10154cde70c99baa7df81001

SHA1
65267ea75bcb63edd2905e288d7b96b543708205

SHA256
a13534df0cd0a79a3a1b91085a6d575b47d5a9aad7fc6d712fd2616c0e95a23b

SHA512
ad8d2b965851c0ddc23e92ae151b3b0b2bcda850c446f4278bdb0754d6b42ead8fc034b394749578a27b33ad7e4ab0633f974dfd4773fbe4d93ae477f00b73f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d6195eb334a627f3e8089e71a0329ccc

SHA1
1aa8439f9a446bd0ec3720420fd80ae98f7a9ba1

SHA256
269211bca14a3aa34c12f4509f9c68e3cfc5b3c6ca508ed02d15cd0ea203e6ba

SHA512
37ab045f69a75ecb5a6438d4c8dce882f024f44817e8f9d39a1d1aa280f2d0b8739c0897b8b995929ee93405c74e2c933ada092c4089535738c014099dc64fc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591bfa.TMP

Filesize
3KB

MD5
4de97a34d7778970efccb01d4674e269

SHA1
4290c2ca477dad68cfc0eb6371dfa4b847aa7e85

SHA256
16bc164873946ff1e0f37241b4c22ea9926103c581484c5a19ae09e122ee30e8

SHA512
b90ecaacfc6378f6bb17070eb04cfd0ff343d2bf591e7352ab0a41a880baf66f11443d67f14615c2caf8f8c6400662d62abd806d03a63edabb1dd4d709a98623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
1286c1b883b4181c9eb5c58bf08fde2d

SHA1
347a71652d088b795954496ac2d4976ea71e529c

SHA256
a57979fccad6082917e8ad0437b7393ac8f01a20fcefba2c2114bf3cd14cc3b5

SHA512
c5e04134b4885a45df1b2041d38b74c15cd12afbbd59cf09a49dd4f52c71934c2be9b06725eae48bdad683c26412c7aa6bd8f554f486ce3909cde65b2c8de004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
210993c1bd577c723563889f9d0d2fcd

SHA1
36a11c2ed3f3cfb8643cef7e280915c88f67acb7

SHA256
450a0edc3ffe2211933411602644f76430d7725709a7e39935aaf0aba6375a9d

SHA512
2413b3091e63a90412783d7978dc4174e6db957306bd319999896a50dc801450291c50624a50fe5a9625e5452a17cdd932027304732f6b98fd9ce26e623555fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
540a0177bf139564688cfbe4f0257068

SHA1
888b5d847b870c459482d57e4819eb810c507ca5

SHA256
ee5c32762c6abf8a1e3592eaf54642365bcb6e89bcfbf2b305de1f6918f83589

SHA512
eb77ae187f577ee93ee1dbdcf868a7d328a12d8c046b0d9dd35dc897c604ce299064bff22d8bffd543b655022bb07fdcf32e99150f6f150be40c6190b38690c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
0edfcbb528d4efb01fc6420ad0f81ab6

SHA1
9949695b3e972a7773bacda2b4b6aa6afe4c08f8

SHA256
1a1a61a49dac17a2e0e209f7e7d82f022cfb464752e7de6b30b37801fa554376

SHA512
a806d892abc77e36384cffbb08f156d2b4b1f331a9601fb1d255564311785a5bc056889d74117e2160da3ac14a3c709654e84db78d4710331b19b248cae88dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed0c758e-f395-4996-b2cf-6d4a96ec9309.tmp

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
872B

MD5
fd028233d450c6dc164970ecfb33287c

SHA1
ca0eebc7302457d1f30c9b83155e5ef07f789964

SHA256
e66ed2d98c9d4021d59faebe70e456b7a352792c768b5c85f4dee4354abc7c08

SHA512
3fe1aceff528e20e878287dd41ef480e8f0539756c7beaf6f35c176a203eb3bbaeb0b8e0299507e4537c497f32360c83af2c4702a7c214d75db7fd080ed62403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
a1319572736bf0d54a17c38abe0db7d7

SHA1
399b76dd7238d8c5f21a5398f38d2a70f3db9d20

SHA256
429be33c46edf2e46d24f68c1c676cfd7fbd7c811e07c8fe75bbd1fbfc34159b

SHA512
0731da0e6cfe7f4635e0be13908a127d411c41a0f9331766e5955b7c7741a2d4fabf2a8600e6b61f44962376f50df3ec361449aa167f3959936e1401f9b3a5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe599e59.TMP

Filesize
465B

MD5
d9306292ece06c1349461bca8a9397c5

SHA1
5991f6fa7b27199c0eaa3dcf2e63ff64ee4e3402

SHA256
d490de00b47ac23ced5448fa59a77bc3aebeb37a3b3a10f5b9590a74511186da

SHA512
36ab8a28cf6490a5a4596d4d5c57633e90375533073ead187e53ade7b9e33a7b71df678ecee36dd390a66a7ce641386a92f45c78d79aa6913be51ef335d0d6e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
3KB

MD5
c7569efb2fa9fe93c0ea2f0896f54036

SHA1
e231c700b778b624f6065b035e5803fdd8b4db4b

SHA256
2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

SHA512
c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
56a63f182b2938fbe3e59fbf9681dc08

SHA1
b76578ca24fb20b8bd5dafad4296e5a46735a5e1

SHA256
36edc2510fb072092e4c6b95efe4521857d9dcb7f0b45afdf5e8ef02e5d19593

SHA512
b17246b7c61e26fce1f211311b578d6b3d22c03a042137bb2bb5b23018ce5290a8fbf7a34b2f66fa30b2027296b8a570478f66a144385c320d63c1cef64434f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
958cf592004047733cbdccedaa9f7c3c

SHA1
fbaa743b25eee1c923f7c834777e0ad2c457ed23

SHA256
89e23f5e9e9d26499d6b5e7687d436713b143ec5d5fba9e8bf5fc2ed442de9ab

SHA512
7402bd4cf5973b18ad8e8cbd47ea491cb2a5c4ffcb78c8dcd2e91d63a46134172249c3b25e1fe56ac7d330201750ba1be7119e363afe5928fad95bd9034b32d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
ac2ad76e4693f84cc3783f7bbae9d417

SHA1
851ac8cf8ba21a567200c8b09bed05d42226d09b

SHA256
966036c0d8d080c114d3ce5373270824382b9dced03f80234f2fab78e25315a1

SHA512
005caec888cfbffd1c2b912902f477f3c2d1e365fcb980459172441b9c09b759a2ee42874ad039fdcfface3d693928a2fd75dfe990ab9b51ba61011ef993678c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
6608d5b5c8ca743f86deae1c8ef1ef24

SHA1
5e7d48cccc3a287900fb3477147fcdb4528950d8

SHA256
c51989fc4835db52519a34ba740c3d9e1e79e32c8b61fca09a652037e3612726

SHA512
eaf554c81ae8cef4405dcd65bac2d114d37cb0ede1aa809533226be9ff41d244213815573758c6b7d7818ff785b9d498d6bce661f93239776d75b211d0c1615d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
7f921c9ffc4c3968dd6fd00e6496e4e9

SHA1
5ce54681474050e8e59145f3d208e1cd666c3100

SHA256
19d449d0e0f037b98123cb5786d30c0ef97dbcc68e2a1a0223c22538fabe7e15

SHA512
0c8a3b009afda26b98d620e5f1dfff5c3312464d6f86317f2bca31861d3af39638095d3293602773cad0a0531f2e21849ca9f726cd39fe25d5215852fbfb69db

Download Submit
C:\Users\Admin\AppData\Local\Temp\3e9ed12d-645d-4a6a-9b41-329958117510.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\49b476bc-e568-447f-9a37-c8dd6df70f55.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDF54.tmp

Filesize
108KB

MD5
68406bfd28f87a63c412b75cdfa764f1

SHA1
244ec4ccbdff8458094b5dc272ee9e7333ffd9e0

SHA256
a9cc69cad361c4fca12cad2e7275127cef7f9398ca1022b5832042b05c316760

SHA512
5a95334b8dafd6addce08044fe9c6308e233d5b29b2bcedd12435d32fc873325a8c504efd1d692be43e7e9bd2a75e615224bf642aa1bf122fc3c3524b33e98ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2428_1270981406\9622b9ca-4dea-486d-ab17-5a39cebd2658.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Windows\Installer\MSIAE6C.tmp

Filesize
45KB

MD5
d5ca89ec04b8d2062188839e3a1c9822

SHA1
ec62de307121f1846a9befecdd05f9db8a1361a3

SHA256
7ca109c7342593f94dae644c6162c2a7d6fa71d8385458dc05372b91023a32f3

SHA512
f1fbc362e96a9eb793948e934f9829f7fd6e47c88755164d1b1c6235d044de5d74caf6b3799038e538f64f5e92a5415cb59bd866116603fca1de9a00e40cf29f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
1aeae3addf77250c73aaf515f259ced8

SHA1
176656ce2f6689f29e04cba2e2140983324e8b5a

SHA256
2e67f00651ab2b43216618b5b4345b1014722191ddfbcf2ac9b6a68375cb72f9

SHA512
b122046519c675adb7339ecc1d612576911000e0f9aa3d5b3821268e6a7dff57e1ece4b634b4822a9b012ee399c02be22e2d1ec861fea2766c7a12c15e3641b1

Download Submit
\??\Volume{287fbac0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e888b535-23aa-4c3d-95a0-85c29b148907}_OnDiskSnapshotProp

Filesize
6KB

MD5
16678d4909c1a7aec9c4d97b865a4b1f

SHA1
ee691e4d75ff3566674e253312d9d8cae4e7ed7e

SHA256
5d07d00a9ab269c3ae016611ebb180743aefc6629af0c678195a7101fde0a663

SHA512
bae5b4133aa45757ea6406a241d76c2698a8d1685243505a632db843a1bbb33ef80eaf323768e454ff1c9bc9ae923af3d8bd80f834d04bb6b928f22cc2fb5a46

Download Submit
memory/4116-794-0x0000000000400000-0x0000000001336000-memory.dmp

Filesize
15.2MB

Download
memory/4116-121-0x0000000000400000-0x0000000001336000-memory.dmp

Filesize
15.2MB

Download
memory/4116-841-0x0000000000400000-0x0000000001336000-memory.dmp

Filesize
15.2MB

Download
memory/4116-747-0x0000000000400000-0x0000000001336000-memory.dmp

Filesize
15.2MB

Download
memory/4116-767-0x0000000000400000-0x0000000001336000-memory.dmp

Filesize
15.2MB

Download