locky | d59141259753d70802bc521e85bd4226174ef73871aee39dc4d763290c33281f

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe
Size

348KB
MD5

bc4a269ef127d108659149b6058ac7d8
SHA1

6e92d9c37f2325a6937a3416b1084fa6cbbfa0b9
SHA256

d59141259753d70802bc521e85bd4226174ef73871aee39dc4d763290c33281f
SHA512

2baf73f8860247a6ac352742e4abed159c20ccde2cdabf5dcbe509843b821e90c149fcf9f841e35d67113561a74729239a896c546ab238f497d193dfc98ed995
SSDEEP

6144:9lLhAgl/XxhG1MLAkCg+3K6xW4UisBfkvR8+0Pn28U+3jRdkVNBfH:D9AgF/G1MLAkCg161Un8vR8m+3jqj

Score

10^/10

locky locky_osiris defense_evasion discovery ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris
Locky family
locky
Locky_osiris family
locky_osiris
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp"	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WallpaperStyle = "0"	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\TileWallpaper = "0"	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
1456	msedge.exe
1456	msedge.exe
2284	identity_helper.exe
2284	identity_helper.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1456	3324	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe	97
PID 3324 wrote to memory of 1456	3324	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe	97
PID 1456 wrote to memory of 4844	1456	msedge.exe	98
PID 1456 wrote to memory of 4844	1456	msedge.exe	98
PID 3324 wrote to memory of 4044	3324	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe	99
PID 3324 wrote to memory of 4044	3324	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe	99
PID 3324 wrote to memory of 4044	3324	bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe	99
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 4920	1456	msedge.exe	101
PID 1456 wrote to memory of 5040	1456	msedge.exe	102
PID 1456 wrote to memory of 5040	1456	msedge.exe	102
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103
PID 1456 wrote to memory of 1560	1456	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\DesktopOSIRIS.htm
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x48,0x108,0x7ffe58ea46f8,0x7ffe58ea4708,0x7ffe58ea4718
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11438732743535674965,6408645584395830809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3056 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\bc4a269ef127d108659149b6058ac7d8_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93687e1505c1ec7b0035ee138a0f818f

SHA1
30e0aac75198771077bce9793b3a01e986a83c85

SHA256
740bd997b59ef1b56e71d849321ec4dc3e98e82763cdd15dc0e741e67411b314

SHA512
9f1cb21b6b8fb23d288db126ab5f2437d27cdca0c9dd0d4b679d4c83c0ed3206cef710246be1a10b342cdc363494e1cd28fd05dcadf3ed892cf282ff7ce37c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e30bf4cd12bb65b04ba8d51b47ee6b7

SHA1
8bae8417ba7821ce89f8043952bd57456fc9b276

SHA256
5c39d2023dd7d9b59593740f96c8709775531076257bdbed4cc8c40dc3d95a81

SHA512
c3f8c4294b76dbcc3658ac45c95504c43cece543b3056bb1c5e30cef192a318a6c9f2ebe243ff6f9c1525f443571da72bc1ce37d0b9f5aa83f780e6526203f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5985f94adb0f7920e6684b9a7dfdcf9a

SHA1
94e3189679241e40305d5ea320ad46d0a49927c9

SHA256
5f81bae9c313c04d160cf93f9b4f9e99452c6c56bbe3c47ef4d6c0d0106e9924

SHA512
8a5c997121832a2141079b15061d1b327571f0695e3c3f812c8384c239aa3ebb273f5950a082ae7894218f2f8f7a0aa7ddac6ab0ae39626033959b1dfe3325d2

Download Submit
C:\Users\Admin\Music\OSIRIS-2488.htm

Filesize
8KB

MD5
10a9f01c9caa1ac167ab62adfa8106e6

SHA1
8f320301159cd7fcb041368af86dc4ff27963fb0

SHA256
375bf49117c36e801275f7274608056ba9a5d9946f73cb3ae745a5520e24f3bb

SHA512
ab269c268e4cb379564c782f9c2d7ff879ff6de827d1b7c58682c7b73ca0623c74b221fd512156a8f3b462f074541601b0bfceed0444162ba31988a45339f1f1

Download Submit
memory/3324-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3324-357-0x0000000002260000-0x0000000002287000-memory.dmp

Filesize
156KB

Download
memory/3324-0-0x00000000022C0000-0x0000000002351000-memory.dmp

Filesize
580KB

Download
memory/3324-14-0x0000000002260000-0x0000000002287000-memory.dmp

Filesize
156KB

Download
memory/3324-13-0x0000000002260000-0x0000000002287000-memory.dmp

Filesize
156KB

Download
memory/3324-15-0x0000000002260000-0x0000000002287000-memory.dmp

Filesize
156KB

Download
memory/3324-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3324-10-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3324-7-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3324-6-0x00000000022C0000-0x0000000002351000-memory.dmp

Filesize
580KB

Download
memory/3324-5-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3324-4-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3324-3-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3324-2-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3324-1-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download