locky | c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287e

Analysis

max time kernel
115s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2025, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe
Size

4.0MB
MD5

7e0e9d61b4719a57f69301984f2e29e0
SHA1

ad08f2cc627d9d1bddea42b99003a3ffcb20a1f7
SHA256

c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287e
SHA512

b7e6a8013fc863107f2b7b3be0fef863a435dc492e4ee3afa4820e1ffc262b947bed009f0ed3567c9eb06b213948a1211117db44142101f3a9d46152006c93a7
SSDEEP

98304:J8NPKZC3KHXThoNyx8bOpgSrU4d5SOAy1pHbMuJ:JoPKZC3KHXThoNyx8bOpgSTfX1dFJ

Score

10^/10

locky locky_osiris defense_evasion discovery ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris
Locky family
locky
Locky_osiris family
locky_osiris

Downloads MZ/PE file 1 IoCs

flow	pid	Process
37	3716	Process not Found

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp"	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5096	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\Desktop\WallpaperStyle = "0"	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\Desktop\TileWallpaper = "0"	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
552	msedge.exe
552	msedge.exe
3040	identity_helper.exe
3040	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 552	3348	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe	103
PID 3348 wrote to memory of 552	3348	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe	103
PID 552 wrote to memory of 3928	552	msedge.exe	104
PID 552 wrote to memory of 3928	552	msedge.exe	104
PID 3348 wrote to memory of 1740	3348	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe	105
PID 3348 wrote to memory of 1740	3348	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe	105
PID 3348 wrote to memory of 1740	3348	c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe	105
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 3932	552	msedge.exe	107
PID 552 wrote to memory of 4684	552	msedge.exe	108
PID 552 wrote to memory of 4684	552	msedge.exe	108
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109
PID 552 wrote to memory of 4820	552	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe
"C:\Users\Admin\AppData\Local\Temp\c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\DesktopOSIRIS.htm
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fa9946f8,0x7ff9fa994708,0x7ff9fa994718
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6955909152551331054,16470784850523954063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\c0f47f5a597be7135d9d2fc23cf2563a3b7117f8272bc794cc745266394e287eN.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1740

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDg4MUUzNUQtQzVFQS00MzEzLThBOEItMTk0ODI1RjhBQThCfSIgdXNlcmlkPSJ7NTFENThFMUYtRTA0Ny00NDZGLUEyNkItMzA2Rjg3NjlGRTcxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzE1RDgyNTMtNzQ4OS00MDFFLTg2RDYtREMyNDI2RDBENTY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4NjAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODIxNjMwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjE4ODQ4MTk3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff4d54b3aadb5200432594708f095e82

SHA1
c30bc1677a50697ada032b1be526b0df6952daf1

SHA256
f63398b148e870edbfe75f8a7d717a64c87b8a05f35ae577d39d157744bfc78f

SHA512
bcb34a847f9b1c2c4347008a8208def98a07bf55d6c11cf6e0b237df1e5f7f5f3a7a58c3b7d0efb1c99ca8f2fc41c6fe776a8fe205840f9f212bfcde67e3f8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f27aebac6cf2154266da570473c0bab7

SHA1
088feed439d7d1bf0962a0d7973a00808632d9b1

SHA256
d11ca93fd8845403bb3deeb8333637cde2f52ca868dc78d3e36a3bcd10ae6e40

SHA512
e56f8e3aefbaab4e792cd989f28b9e5ba069c432a98ab039829a278cd930dd550ee2f1e9d3f45307eeb67a56eb7858d1281afdafebcaf6833ba8bf1b3d6b0753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d49c111fb511fb9dc9059dd0a619af5

SHA1
e423121786c3b0cf70199ab904d5cf39b76b157e

SHA256
a46906ee9d17d1a80e4c08dc93d463b431711c778c0f14d2721aa1192d3c36eb

SHA512
30327048392f01498e4b870d3ee8898d2710b3629293f2feb26ff74d968905148f9ca181469ded60d22f1f2249c50b70d79f3b770c174f9a1bd44f13cad2073c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
829645a4619be5171431a038b8e73eff

SHA1
55b3611c6f384ddc33619abc45907db221840af0

SHA256
f8cdd36f895447de1534aba4924181f314971035bdc232c072674820d50a859c

SHA512
50ef61ea38b9aec397ddd8f5f85da2b8f51f7405ad9b5eda35e875f70eca5c64e28ecaf8621e017818892705a71125a29754e9e285c5108fbcef4a12539a8d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14e680b35ae4d63c76c702a509d7af7f

SHA1
e5527b7169d023853a57bd7679336587daa3e375

SHA256
e6117fd0ad8effa7670bad7c5cf6a57e0d6e48b9fb98d2490a032a896407e01e

SHA512
b525b7cea4c1470d508fced5f237ceca0075eba93646af2370d7eb7d5e7bcf305ab08c239278ca82d8beef9a51c47165f1e1c007588dca14557a4bde9d155058

Download Submit
C:\Users\Admin\Music\OSIRIS-4cac.htm

Filesize
8KB

MD5
c1837142420eb63c82d688ca98a95b33

SHA1
2afaeff0a88a9414b16cf402bac61ab2a353b25b

SHA256
6cdf3fd8bfb7c1a882c6f4d5c8780360a380d291892a5131a34d1564cf6f3613

SHA512
b2fb60eca4298ffc3dee65f70bf252241ef51941797e0410fe4a84bce297a3338eac99b52151a008ebe37396a4593785d712fe9e382c839156b86d293c29d409

Download Submit
\??\c:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
493KB

MD5
4b7a5cfe9734ed08b935aae617ee4d32

SHA1
26ca74a1bec74e591ccbd0efc945f9abff03c556

SHA256
7377f3fa71484e80c8b8f16e273505c921d73492b2e6dcab886b7a947b5691fb

SHA512
c542c6a2672681d8290776df45c013ea52e2cc1a5bc30cfdd730fe242fb2a18ae22367cc0289fe98c5d9d7a080f6e5924f9ff57519336c2be818451519e0dc24

Download Submit
memory/3348-5-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3348-19-0x0000000002220000-0x0000000002247000-memory.dmp

Filesize
156KB

Download
memory/3348-21-0x0000000002220000-0x0000000002247000-memory.dmp

Filesize
156KB

Download
memory/3348-20-0x0000000002220000-0x0000000002247000-memory.dmp

Filesize
156KB

Download
memory/3348-9-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3348-342-0x0000000002220000-0x0000000002247000-memory.dmp

Filesize
156KB

Download
memory/3348-8-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3348-6-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3348-0-0x0000000002430000-0x0000000002477000-memory.dmp

Filesize
284KB

Download
memory/3348-4-0x0000000002430000-0x0000000002477000-memory.dmp

Filesize
284KB

Download
memory/3348-3-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3348-2-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3348-1-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download