locky | 9d7016dccdb05939eaac3ca2452cf5ef9d22a8e3a0e8e60b555b41506f95c36e

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
27/10/2025, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
Size 255KB
Sample251027-plergady9c
SHA256 9d7016dccdb05939eaac3ca2452cf5ef9d22a8e3a0e8e60b555b41506f95c36e
MD5 49af0845db502e6965aa54ae5d35dd9d
SHA1 4d0c139579bd6c52cb1c987c4dc3b07edaee4aa5
SHA512 fe189d182f87de7a9608d9768c2b28f083328494860771f6791538b54a8acaaefebdca75eeba06cb69309da3cca69ea9f93ca03870c9a29b3df67e2c6bfc920e
SSDEEP 3072:Rwp4q7T9LhD9l2Q6MfLoYivy/KtMpsd+4ldKlQJ9ZfR5JUS3+moKYe5DecRA5jfE:I4S9LhZl2Q6MzoXSsXmBS3Jl1FAj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery locky locky_osiris ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris
Locky family
locky
Locky_osiris family
locky_osiris
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp"	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Control Panel\Desktop\WallpaperStyle = "0"	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Control Panel\Desktop\TileWallpaper = "0"	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134060416324125976"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2318277690-2490144949-3346562762-1000\{27C79CF4-197E-481A-9D5E-8020A720251C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000_Classes\Local Settings	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5408	msedge.exe
5408	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5408	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6060	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 5408	5324	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe	78
PID 5324 wrote to memory of 5408	5324	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe	78
PID 5408 wrote to memory of 5184	5408	msedge.exe	80
PID 5408 wrote to memory of 5184	5408	msedge.exe	80
PID 5408 wrote to memory of 2284	5408	msedge.exe	81
PID 5408 wrote to memory of 2284	5408	msedge.exe	81
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 5756	5408	msedge.exe	82
PID 5408 wrote to memory of 3644	5408	msedge.exe	83
PID 5408 wrote to memory of 3644	5408	msedge.exe	83
PID 5408 wrote to memory of 3644	5408	msedge.exe	83
PID 5408 wrote to memory of 3644	5408	msedge.exe	83
PID 5408 wrote to memory of 3644	5408	msedge.exe	83
PID 5408 wrote to memory of 3644	5408	msedge.exe	83
PID 5408 wrote to memory of 3644	5408	msedge.exe	83

C:\Users\Admin\AppData\Local\Temp\2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\DesktopOSIRIS.htm
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f8,0x7ff91051f208,0x7ff91051f214,0x7ff91051f220
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1776,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2056,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2308,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3436,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4552,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4568,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5724,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5784,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5740,i,14315982614562586295,12526796890513742488,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:5252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 21ddfb155455e1b2bd1e291250ea47e49ffa970172e8ad0bb0eb9e1724cfd0a5
MD5 41e61c453b8182f1c16003e05e93feb3
SHA1 224dee6a422a7559c312cda15f7ecd2899f52d27
SHA512 5256aac6545bcd432d9c38facd8da427ba442bb3e2d6762a33a63ee77e49b50a43f19ef57540ba2b4e677e905febac6afc18ce5657bfacef7599b84d22dbba34
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 97136bfa0bd4bf468f228d5d53d4c0759db019a1e417f4987fa91316e824afa3
MD5 f230fdefbc8e381e07d1d7a40ca9fbfc
SHA1 aae2d588e9b519b7fadb203f93903eee30bc7a98
SHA512 3421875e0d887baae4d93c3ca407b8ff6958df9b4113d0b3110248337af74b4563fd45c0308e396bc3f84230aaa74087d1255e11e3e8b26c3c63d62ed3264d4c
SSDEEP 192:sVaRNyMqv/K1Ml8M3pJs/iU9S5wUykzoZ8pgM/Y+WNrY0z+DuPy+x4nWHGcIgLJ:sVa0PpJsKUEFn/Sr501o4nWmAd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 e078f1a90dcf616ffda7dd0053a27eb87f66ea55a494ee4ad996ecf8d27b2e01
MD5 ed7fa36df6da8d4418a147cc29097dba
SHA1 b055997611955f3e1c94c6b1a2a45e2b1fb9f012
SHA512 733095d30dd6fada812faa1a29d2764c16c34dbc5c361d96c822702006c86550da9f3cd40240d50b0a273f32271344c165eeac33003a77c8e2a08ba26144e7ac
SSDEEP 768:OnHyZ8Yt2oL7pLuLl+MWRW40Q8o8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3edeLLlD:OnHyZ8Yt2odEl+MWRW40Q8ou1jaKedel
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 21KB
SHA256 4a621701dd6abf97f8fa755989a4c037295f1716025149b527bf9223fbe88e84
MD5 261f232968d61087e68181ff1203e6b2
SHA1 81e0bb6da9b74ab921715be8480b7df2040be284
SHA512 f2ef4f10d5ebeb47d76dc37b20027eb122760b02e4adc5dc24ce5d40c256ef77001a44beea852ab853965d1aa78a449fcb15d3d127e81b567108f9c6a4af313a
SSDEEP 192:/cpOCce+FiLO6QS8MD6R+S/c+nsxB6VmagoY3ozaaqss6rcrQRG:O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ba1e23e4aafc598c89d962cfe517aaf67c4bcf495b738228a07a7fe9056d4e79
MD5 cf582ff86245514884bfc3f98c175dca
SHA1 36acb5b516cd09dbd576d3d333e84467783df64d
SHA512 3fdee6f81445e586faa9f648b9b9d78d5a2848130f77a2ca7dec07bbd94b5a55a9e4a679fdee197a532fd20807d32d11a5a68ab8db864477bc4c42d2803cbda8
SSDEEP 768:jF5BLv7I5wCPFdV6Zi63UCgbAw/BJ8EgBx5KfM9G/Qocjja:jJUV6ZL3c/cbKx2jja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d7d62be04e980ec265013099bf9352b01cb8341d9e2e1e47bc0787505aadec63
MD5 44647bc51d989e8ba9bdd070e13cc611
SHA1 70dce2c42b8d968bd529bfa315ef86fd683e3f03
SHA512 4f942cd45d70c7d496e76d09255a8644c83933d73d990de92325cee21db61a0286f3420ee1db73127f40d6f3b74704a2c8ce1349d6eaebf9082c9553c9e5c507
SSDEEP 768:uF6BLv7I5wCPFdV6Zix3/CghAwrm8EgBkRBvME7rYqOjfDoc2+:TJUV6Zg3VDgBkE78FjB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c9e72bf3844ac8d2df3023cf5ac7df1e8b547b5b8a48d28f0617823c2eccd4b5
MD5 5f5be954b51c171a7f9865ac7e94b26e
SHA1 f856a53bded7e2a2f4f815e4892c3d22c0576db1
SHA512 8498e563f32d9433dfa914b861ffdc9606f1fd7ab6d35acee147d1bcb8ec9812f16e85a24ecdd0442f8924747712362411fcc0503f34f049793d5b2e2e03f66a
SSDEEP 768:uF5BLv7I5wCPFdV6Zix3/CghAwrm8EgBkRBvME7rYqOjfDoc2+:2JUV6Zg3VDgBkE78FjB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

DesktopOSIRIS.bmp

Path C:\Users\Admin\DesktopOSIRIS.bmp
Size 3.4MB
SHA256 11b963e85ff5ae13a631906ff4db9ebe71a8d87db29f53b03f54dbdbfafec743
MD5 7a478906c77cc328c6c715df51318247
SHA1 54dbf3e11adee2776524c34d2043566e6efe61f9
SHA512 dacf1881ffcee610958c5669a40c2cac96dfed8415371d3dd2c4b5525b71bb45f6da7557f3508904d2735da6dca63a752a13c4d9e9ad30319497b0990e87eaf7
SSDEEP 1536:VVOu/3y3FBUPH4l5lc/gIo/Mmeh7xFf8Zt+86B:So
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSIRIS-71e8.htm

Path C:\Users\Admin\Desktop\OSIRIS-71e8.htm
Size 7KB
SHA256 7bbf99c96dae256a8503c4acd0abedce9a34647d12171f58674067ecbb3f8acb
MD5 c8b5761c79d7013cf43b0e619cd791f3
SHA1 3162ee9f8ba9d85b276860b80622de6877763580
SHA512 f292fb1a1b62cbc1f9d7f5ad8d79e85a35aa0c081ee197a0d896a28f46211afb9d4ce765c0dd8727837420731ad85cd65f1787257400e47af06c8a6fe7552f31
SSDEEP 96:5ostG1t/rD/O74JZAlEsNKLk+R9c8uENartg+6yRgjlJ3U0KzLuSt/LwL+JNtLyp:yiLkJkl1fm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2080-497-0x000002CF94480000-0x000002CF95480000-memory.dmp

Download

memory/5324-8-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5324-6-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download

memory/5324-18-0x0000000002300000-0x0000000002327000-memory.dmp

Download

memory/5324-19-0x0000000002300000-0x0000000002327000-memory.dmp

Download

memory/5324-381-0x0000000002300000-0x0000000002327000-memory.dmp

Download

memory/5324-0-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/5324-7-0x0000000002300000-0x0000000002327000-memory.dmp

Download

memory/5324-20-0x0000000002300000-0x0000000002327000-memory.dmp

Download

memory/5324-4-0x0000000002300000-0x0000000002327000-memory.dmp

Download

memory/5324-5-0x00000000022E0000-0x00000000022E1000-memory.dmp

Download

memory/5324-3-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5324-2-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5324-328-0x0000000002300000-0x0000000002327000-memory.dmp

Download

memory/5324-1-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads