hxxps://github[.]com/danielkrupinski/Osiris

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/danielkrupinski/Osiris
Sample260722-1bgc4a1vbx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5024	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292293452702304"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{B8478FC6-AA15-47FE-B4D5-E58C05B8E92C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1884	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe
1884	OpenWith.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 456	3088	msedge.exe	87
PID 3088 wrote to memory of 5024	3088	msedge.exe	88
PID 3088 wrote to memory of 3900	3088	msedge.exe	89
PID 3088 wrote to memory of 3900	3088	msedge.exe	89
PID 3088 wrote to memory of 3900	3088	msedge.exe	89
PID 3088 wrote to memory of 4840	3088	msedge.exe	90
PID 3088 wrote to memory of 4840	3088	msedge.exe	90
PID 3088 wrote to memory of 436	3088	msedge.exe	91
PID 3088 wrote to memory of 436	3088	msedge.exe	91
PID 3088 wrote to memory of 436	3088	msedge.exe	91
PID 3088 wrote to memory of 2552	3088	msedge.exe	92
PID 3088 wrote to memory of 2552	3088	msedge.exe	92
PID 3088 wrote to memory of 2552	3088	msedge.exe	92
PID 3088 wrote to memory of 1132	3088	msedge.exe	93
PID 3088 wrote to memory of 1132	3088	msedge.exe	93
PID 3088 wrote to memory of 1132	3088	msedge.exe	93
PID 3088 wrote to memory of 1476	3088	msedge.exe	94
PID 3088 wrote to memory of 1476	3088	msedge.exe	94
PID 3088 wrote to memory of 1476	3088	msedge.exe	94
PID 3088 wrote to memory of 916	3088	msedge.exe	98
PID 3088 wrote to memory of 2880	3088	msedge.exe	99
PID 3088 wrote to memory of 916	3088	msedge.exe	98
PID 3088 wrote to memory of 2880	3088	msedge.exe	99
PID 3088 wrote to memory of 1988	3088	msedge.exe	101
PID 3088 wrote to memory of 712	3088	msedge.exe	112
PID 3088 wrote to memory of 4256	3088	msedge.exe	113
PID 3088 wrote to memory of 4448	3088	msedge.exe	114
PID 3088 wrote to memory of 1916	3088	msedge.exe	115
PID 3088 wrote to memory of 1916	3088	msedge.exe	115
PID 3088 wrote to memory of 4508	3088	msedge.exe	116
PID 3088 wrote to memory of 4508	3088	msedge.exe	116
PID 3088 wrote to memory of 828	3088	msedge.exe	118
PID 3088 wrote to memory of 828	3088	msedge.exe	118
PID 3088 wrote to memory of 828	3088	msedge.exe	118
PID 3088 wrote to memory of 204	3088	msedge.exe	119
PID 3088 wrote to memory of 2408	3088	msedge.exe	121
PID 1884 wrote to memory of 900	1884	OpenWith.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/danielkrupinski/Osiris
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffe4559c188,0x7ffe4559c194,0x7ffe4559c1a0
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,16205856939622143994,4070048808770408787,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,1200124288168974367,14772835385286520869,262144 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,6508531804881114035,4475854490656398690,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,1635392839485344167,9470179405701502090,2097152 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,8807387211381130780,1618033729096836643,2097152 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,10792989363299242543,917489662193225264,2097152 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,17493154438767306186,17192833109025358269,2097152 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17309714065895280006,10082806030145224105,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8106841975743454167,14622331483258052380,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8022883440816737395,2104240763070293693,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8022883440816737395,2104240763070293693,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,18160466120394897309,5454618950385426588,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,17760072836355283628,9648345543261396427,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,15294797062308347134,14534279961747898395,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,12242750967589108149,4813342268190052562,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,7854753734330363492,3992686268496233816,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6432,i,12895726839805757060,10986257373077535824,2097152 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,13394613203592359868,4691574968503581100,524288 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4944,i,9607843090922989849,18337611159511101193,262144 --field-trial-handle=2700,i,9203614576648941399,7958526912016437867,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Osiris-master.zip\Osiris-master\Osiris.sln
  2⤵
  PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 57KB
SHA256 89446bd616cfa66fd4910c98ad373dff6305db143b6e3ffd4a1c8ed19e33c4e0
MD5 8c8209035f888812ed06324887cc4012
SHA1 960a2c0682fd223539353e6422132283e71f7e0a
SHA512 db365b8c3e6ad7d651a00c60d8a212a189a3f0d979339c1b831522c1b6569cc7c9870a1d09ae84e5b7a37211b65b2d11501d87c85b2b1805fc588bcfcc5e80d6
SSDEEP 1536:pcPh++o1z0ON/AXn/U2idUqif4T5vNkOr+twR:F+W0OhAMhCarW2
TLSH
T1644312873EAA6A34D8BC842511D86B96B71DE1C796B3462BB7C3300B5CC04765E0EDDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 34KB
SHA256 dcb06bb6c4df1f8ca8b945b9d2e50e54fa503ccc05ab81f7e952b04a41702dda
MD5 2db1b7435e44db6b6ff16b142eef8ab4
SHA1 cf3212e8a148e566c21ff9634d257a983a4b7a5c
SHA512 078b9a7319be3d53d4d02603235fa243e0513bf26ef3307f94c7d24e51eb83393b320eb0af1b6cd99952863837b797c08f1a379e412319156fbf720eb71e583e
SSDEEP 768:xjnKlhN97323ulOKj2uTyutyNe8B0eeRXW85aZPm4svdY:xTMXJCPruTltMe8yeCXW8gZPdaY
TLSH
T1E5F2F1A8765C90D596CE6E09D83B2340E0DE82FFA342D99867C21BBC2076C526904EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 577KB
SHA256 02b3f5cdf7e5724efd970cb95d0ab270a603d680002f634695e1c0ed464ec5c7
MD5 4d1b05d0ef8c5e0d71d134ef0e09d3dd
SHA1 d253a9385084ccf1bc56fa8b2e08e11ef6dd18a7
SHA512 7090905b7a5a92b2f91ba3c7cd1094461510096d57f2d6f2971cac53282d5f8c492665cf495f36f2b2ead6a6e89c5e691f21791830ce4113e17bdfa921578b47
SSDEEP 12288:JH9xgZIAyHIBdfymdVZE4Vdm4KhMkl27ddkStM8L9shHgp:P+5yHEtbVfdpKqk2hQgp
TLSH
T190C423104B2162787E86B274723B9CF2DABF62C15BA5444BE9D57226EFE40A77314EC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 932KB
SHA256 3dcdb68bd14a5e2654d71976c5292fe0a6fe5be4626bdedca342c3294f802f7b
MD5 5f141a05b0ad9fcfb4c1d200df28f311
SHA1 d650a95765ae96b052f15493a56d520876fc30e1
SHA512 904cedefb0fb90b9676dcc7e57dc555caed3cd88610e7310bb31c61b1cb5aae6ffacfe18e917d915530381f8fb91663908dc7b8c3fa3173f867553e9d63b2894
SSDEEP 24576:TqmogFj7OgucFNQ+ONRkZ3ZNdCIyl7oJvhMAVZMa1:TqeXOnYYr2pHCIyl7oJOAwo
TLSH
T12D1533023F8454E46254E3F0A0F37D7C9DAE82C33DE4BB2651188D76998E8694BDB7B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b7f217fa0ec75b5174bc3fa21b999d14e7385793a2b1c4ff9c6343e9d8a779e0
MD5 70ab7effff3547159ee2e7570a6341b3
SHA1 a18e5038eb682292136e8d016b29c4c802964b30
SHA512 fc50111afef29fb00a2764702547c171368f9ff8086b35831587d6fad129742009b479eec60dac6687cb90eb0066e0c06f1b4d837b3297e29afc8af5c32d45ac
SSDEEP 96:TBzx1B0Ney/ADzgJg4iQ7QG2oqem9OU8SkGW9L+2EQQUjfYpNDU3dBntMNarsO5W:cs2iQ7hVZzB+d6TXCfFcopkXW
TLSH
T12FE13CBFA799ACCAF710C3702CD99E39B57081F8F8679EA5FE90C472098D741430AA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 8f7513a7e060459a1f9ffcfc9cbd749a71e232a75d67b286988a6866483624ee
MD5 0c68a7621114a2e2e9cb2e11f24b4085
SHA1 b44fc7e2a295530b68e92d4f92a642b6a38ef5f1
SHA512 9ebf862995d072f5eaac1103cbed8c4461817e5b8a92616ced27a13e8b0818539d266965e12e727ad6c689b63a0627bf73f5681f38b5a4bebf9a23ca5477c612
SSDEEP 96:7szJzx1OoeyMdPmgJgzQ7QGjoqehOU8SzW9L+2z3zUjQYsNDUKBnFMNarsO5QfMm:I9GiQ7eV4B+qbPr0G2oak4
TLSH
T17BC106FBA3989DC8F711C3302CD29D39B6B081F4F8579EA5EED0C5B2091C741830A964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d992.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d992.TMP
Size 3KB
SHA256 93782522fa358ebd29c363656279a6895553a8c750d787dff9a8446e1a0caa02
MD5 7a8f756e41aa696541c5a5088189119c
SHA1 de5269ad54436a3a86d33522116239a181788e6c
SHA512 481dad9eef2def1dd5570b4fde74f88df6ba081888b6f5a4e6e505e7ff95ca5eed1a8805c618a0d9db966c346d8220b8f6279f9043c8e762a6bd2aaab917ae05
TLSH
T12A713B3B36C89EE8D35103B13DD2C208F1B182D9FC979BAA7294C4B31915B12835EDA4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eefb00aa51631dc14b9722c03fbf7be100e496c005bfd1aa123950cb7c0744f1
MD5 4553712cf4a163d424e9bc9ac7a5b8e0
SHA1 13a0218f73ae127721546120ab050c4c11796248
SHA512 61fdd2c78ec23430c034eb014db0bc37f9f183d73ec40d98901303cd3de9b336e738122826daee51575e4baf58d698316d8459f3fee537882a9486e2a23c5783
TLSH
T12B4179F787E2956D8A0256F0AA18EE1BCE2D0511831C7C6985E4BE57D3E3871E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 43a77cfe512e81986d9ff9a61b9bf8c71b3bb98b94bdbfb3e937eb79f3503d87
MD5 5376885ba1f96ec5704a3a576009f9ae
SHA1 c32daa545c942021fa1a1e125920071743c87fce
SHA512 c9640df8714a33f87472e5b9fe08ae0850814407068a1a837ed93289e6e47b56852a43aa227ce0347f646f7d88f7fff478fc0011de8480d0af9917107182be8b
SSDEEP 192:sxZJRiyM/jK1Ml8Mkz/fzslgduIdpDYHW6+WNYIP/YC4uzp0IgrJ:sxZJEMz/fzslQ/UHbz/fG9
TLSH
T1C552F916AA349977CDDBD209FA45BF53D6F50572D2901E84A9FCCB0C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e3e0ff58154cb80e021477eed27480d8634b145bf69f3deb44d62b641ff27775
MD5 7b8f553ab58e484d6c28f74e39882464
SHA1 0bf79dcb044230c6a6bf0514109a4d1479de6c27
SHA512 5ae84f6de98a01e522f748ce39c1e9b958053c2b72a9799903ac637a13f00526e9e76e7e97dc104b41bf8637f238037cd950840923c81c6f9ad57d0b44b31b4b
SSDEEP 192:sxZiRiyM/jK1Ml8M9z/fzsFdduIdpvdYHW6+WNY/FZYC2D2p0Ig5kJ:sxZiE1z/fzsF//iHbKZDGu
TLSH
T13452D716AA345977CDDBD209FA45BB53D6F50472D2911E84A9FC8B0C04EABED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 50c8d7635d57ee27c23978ffb52493033a0bb75311abeb1e1b024e2bf6928001
MD5 3f97a946cceb29297dcd34f1f9a6879d
SHA1 22fe80dc313ba4484029a33da05f774996881e4f
SHA512 0a9fb0025d1e519fb78db36624443c6a5c774952aa029698e99e78025a9749374a71fc0670bab7027a6af457355fed05a20a96c265f8c3fe23d8fce0e67e6d50
SSDEEP 192:sxZiRiyM/jK1Ml8Mkz/fzsFdduIdp9dYHW6+WNY6RXYCiQzp0Ig5kJ:sxZiEMz/fzsF//QHbnXZGu
TLSH
T12A52D716AA345977CDDBD209FA45BB53D6F50472D2911E84AAFCCB0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0fc029e3849011c29ce1e6d977ac57f27a9a6ed619f597491c9dec5da0545928
MD5 0bf44c67fabd6fff8f021637331f10bd
SHA1 74505be6afcc31c3dec67251dd8abfd9910da026
SHA512 398352a42c3b9dc62880841944212fbeb49fe96950f21966729b30e849ab6b5e6213f82d9581fedabd3042193c00ef0168723667bdacc123d2cda6c848f81d15
SSDEEP 192:sxZiRiyM/jK1Ml8UQ49z/fzsFdduIdpvdYHW6+WNYQ2xYC1N2p0Ig5/J:sxZiEqOz/fzsF//iHbyxOG3
TLSH
T13862C616AA245977CDDBD21DFA55BB53E6F50472D2901E84A9FC8B0C00E6AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0026a17766445ff2c0ecbcf8b42f86e9e3297483970e1a0f35e0d075dbe89ad5
MD5 4261765e3e3c1fdad4107887d39c46dc
SHA1 b7ced74890877e1fc9b1edab06a7055b66621182
SHA512 d5ad69b28c5d180b3fbc88c61c3a3583ee8d34f715183b7fbfa8930a41bb5c877d202d2e086439e08c7453563c9d3afb794bd7e38d7b656cdd20aa73563ef961
SSDEEP 768:1q8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVyroh:1q8bqn+WvSCt6u1jaCZLbWVph
TLSH
T1D3D20B3B280CCB7E4F845E5CED266F962DD801CB67988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 6d6a450f8e78447aab6228ea0f1809cc5f47de916e4e75dc717d7a2acd7d46f3
MD5 84e3bf9e3858fc2cf79d20bdce44cb2b
SHA1 683df5474ff032fceb34b0fc7611b6b03fbae77d
SHA512 0f60a83a1a4c1ad785cedbc812de68af2fc1edaaffcc0deb29ae1d8edddce76ec94d6aed248274e33ce1e9257d5664512823c5860ce9da7f7fd02403d0a70822
SSDEEP 96:K8UgKNyWOHaKc4TjOKIUSqWkKnqk7aKAYag:SjNpdPCBg
TLSH
T1CED1F42331BB0241387E290CA3EEA5779E9271633414B56F7BB850E21E66E115CFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

301fb598-72b3-412e-ac99-2dedf8746263.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\301fb598-72b3-412e-ac99-2dedf8746263.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e618b8e3ca1d308ac935c52cef8b3b8e46ddc950d9fec7ab89248be9b5fe4216
MD5 9e16a9ee0117f49b5b8d90f892e57974
SHA1 e40621f49200e8b798acb73c1371101e244b985a
SHA512 b5fb5dc2cda303da978ad3e671c18df8543af9cff30face2b614ccbf2c4ecc80afade54c65230f048885f5c5fc14bb1a9bd0baed2477bc7d69801d1a6b383332
SSDEEP 192:ufm+xasuheOwQxMGsNBKQqkwbi9lQmiU1ZfH4Ea+jXOm+tmUJ/eam8q4fScjmqYE:BZcIhsNBKmNZXYEa+zOhzlmaScjmwezm
TLSH
T12F927D37BD789C766AE69145F88636138EF89073DA852BC0D5EDAF0D00DA5AC130BD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a5d8a22c2dd0bc0de58b939a37929966e45a04cc248329a63f886252967d9234
MD5 1d9c2413df06cc5e2ca55ecf220a16c4
SHA1 6235597d1f8fd896caa606908843b088b3538c4c
SHA512 410176b2a0b79f4db2a648f1ef6aea23fcdf6c4510374dcd2e7c13d742bccbd18ff2b10d78604ece97bb819cefded4f687ecdc4d40ef8dcdd874adde00e6b92f
SSDEEP 384:6ZiFiZcIozsNT8TUNTUlIljmNZqYEa+zOhzlVaScjmwezm:6wFQU2wggG7a+OfVa1jaq
TLSH
T1D7D219F758E78836DAAE5747E77D2E038EBCC063B5845680B3985A0CCC961BFC306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 492f95deb388b54623e6aefaed7b2b504aa457f10b4758f2973b6d9cf0ae3d45
MD5 b9971ab2ddc54ff5d0400a3a2d98a456
SHA1 3599388d4d591f0ceac2d7c6fcf8473512954540
SHA512 9d8ea606bc2e41f8da56292d4ee62af9a66da05a9d077b6fe4e8544b9236f2790c56332cc5d2944a5afcee37203676a5702687dd9a592027fe0ca4df945ad3c0
SSDEEP 384:6ZiFlZcIoDsNM8TUNTUlIlfmN2qYEa+zOhzlbaScjmwezm:6wFdILwgwx7a+Ofba1jaq
TLSH
T184D219F758D78876DAAE5747E77D2E038EBCC063B5845680B3985A0CCC961BFC30A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 168c35d54c033a50699c15b0e95a05984246c4091ad86a6bca8251c5f8c4fd4c
MD5 bdd49bf5f8c4c59d47e48c2ed0bbac5c
SHA1 a42014def49a5393b6972eaa24db2a2b441f1b1b
SHA512 156fb37785ab74705ac5513e763bfc25e3a6ceb159a839414fd73498fe0c505597928bc5ef202da833ccb08fbd804f5a8969536eb19c4e6f50c15f3bc4aa36ab
SSDEEP 384:iEZcIhsNBjmNZXYEa+zOhzlmaScjmwezm:iihRL7a+Ofma1jaq
TLSH
T14F928E37BD789C766AE6A145F84636138EF89073DA852BC0D5EDAF0D00DA5AC130BD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8bbadb730d1f26227c107f7630d500e5297bb5049aa6d000068ae8d245c62379
MD5 5a49b99200d97273298067048eb72e46
SHA1 b626e44d4533c09add7d6db30b5491d2d309ba35
SHA512 3d57c1efb19dd1b222edf86cf8b9b2f7d6641db5ae92eb251914b34343220b4e439d5ca33d141bc54a2ccd9b78d383605ee54c979c627ffd3747a82601ef23c0
SSDEEP 192:vONp6Db6QmiUy8MHBa+jXOm+tmUJARgq8mxU6:vONp6uiHBa+zOhzJixU6
TLSH
T1D702D83969785CB79EB2AE49F8873B279F94207BDA562F84D6D81F0C00D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f6540ac0be01328af56f34cc27f49b31220eb163ca4402cf1f1a76793ffe81a9
MD5 60f0372ad9189f32f1b1add040f5764d
SHA1 4889d8a61150b887ea8fbfe05709da6a39a9f786
SHA512 21529b743c0a8320c244d8997e2a4b49519b09d44df9a8cdec265ef0fa833cb11ea2fd690e380824f5a5289b0a8e365b5ea11db7378027578cc80a5ca21b5d1a
SSDEEP 192:4ONM6DbzQmiUyeMoBa+jXOm+tmUJ/+Nz8q4fU6:4ONM6NKoBa+zOhzliaU6
TLSH
T1D012293AB8789C775EE26584F48736139EE85067DA8A7FD0D5DC2F0C00DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beddfc4c-1692-4e96-8232-48ac2bc81d2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\beddfc4c-1692-4e96-8232-48ac2bc81d2f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e432f38fe5f378c8342b720db3193e8459e9a25556d629cfbabc413be41b879b
MD5 4fed15574e6f7960da4e91812ef3a128
SHA1 568cdcb5d198802c87f747f70f1e01884077e268
SHA512 2f70812f51d4c58702e03f4e52a0896de80916501e65f7d56f74a5a042e2ac97c3168beb11a7de81bdf7443ebd1bf1edcb2e841475e95f1ae985e53db7973c6d
TLSH
T1EA411858B6E91148B3B66F569BF6A8AE487FBC773E06D09D10110D4F0A22B40C972737
MD5 SHA1 SHA512 TLSH

Submit Download

Osiris-master.zip

Path C:\Users\Admin\Downloads\Osiris-master.zip
Size 529KB
SHA256 2a31d8c9562110f0551494112712609e640149676fc6b8b61957cbda5cd30137
MD5 194163b39be329926f61e5d24748e54e
SHA1 fa2716dd9a454cc4e78bd40c0686bd11dda15210
SHA512 7ef04d767881766e9b5366cf3f5c225b430eabb5222ee76cd3677c21a6518160b2c717911991a4970e88107daf8c2ae8d1b086e6300639bbda19a95011dba035
SSDEEP 12288:3YZeaZ0qNMaYLGZwFVRRQC70AdzTUdBCEjr8Rw0W9f:3eWaYLAwzRRQC75dzTir10Wt
TLSH
T1E6B419F9C2153D3BD94B35FD1D459323DDA2D18031D55A6EC0F96028A8FB21A3E88B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download