locky_lukitus | 4b6ffe7c8bb710c3b3e7eef0a79dae32ec9c3a4a3684d252caff3f8a33bd8856

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe
Size

595KB
MD5

c537ad6b878730ba88834bdb361e3bd7
SHA1

f6568b081dd562bcee939c9f691184b37ac10046
SHA256

4b6ffe7c8bb710c3b3e7eef0a79dae32ec9c3a4a3684d252caff3f8a33bd8856
SHA512

1e3b631f5178084ed49c5d22513c67aa6f8291aeb7a513f5aaeca44c83bd0bd0efb02c0d67b21e8829fe277c1befed01ae5e4bb5dca4befd2a28069e20451f05
SSDEEP

12288:/mDxN5Hef7wWHX+IuNEFVqhJuWYI17c8Z7zo1N92:YN5+f7t3cEFVq5Y0wu7zoI

Score

10^/10

locky_lukitus defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Locky (Lukitus variant)
Variant of the Locky ransomware seen in the wild since late 2017.
ransomware locky_lukitus
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\opt321 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe"	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\lukitus.bmp"	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3416	vssadmin.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\WallpaperStyle = "0"	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\TileWallpaper = "0"	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
4476	msedge.exe
4476	msedge.exe
2600	identity_helper.exe
2600	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3724	vssvc.exe
Token: SeRestorePrivilege	3724	vssvc.exe
Token: SeAuditPrivilege	3724	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4476	2624	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe	103
PID 2624 wrote to memory of 4476	2624	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe	103
PID 4476 wrote to memory of 4512	4476	msedge.exe	105
PID 4476 wrote to memory of 4512	4476	msedge.exe	105
PID 2624 wrote to memory of 2552	2624	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe	104
PID 2624 wrote to memory of 2552	2624	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe	104
PID 2624 wrote to memory of 2552	2624	c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe	104
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 4480	4476	msedge.exe	107
PID 4476 wrote to memory of 1620	4476	msedge.exe	108
PID 4476 wrote to memory of 1620	4476	msedge.exe	108
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109
PID 4476 wrote to memory of 628	4476	msedge.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lukitus.htm
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80ee546f8,0x7ff80ee54708,0x7ff80ee54718
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:2
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8534919550374596387,18191693890716204264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3724

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
1⤵
- Interacts with shadow copies
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca54ccb8efcc0ea4ca7107f2ddaedb61

SHA1
7a8e975267d65806a8d8efa02e5919e2bf6b19d8

SHA256
1956ce766d98e82562a222ca99aced500c43a241fcb5c33b0fca7f692b3cbc07

SHA512
a30b267c112290d97a0186b68ae4e434500b9dcf5b0593dcc11297785b0530ac4dc72928c76d7c65e648c0013e1be7df73a7f9a30a7d7564cf7fbf7b256e481a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e20ec98d44ba8cd2fbb4414307d9886b

SHA1
9d49d3a6c83b7f58cd54d03c95995529bcbe01f8

SHA256
829b35f0042aeca3c596ca8be13eb8aab5e48fadf0e7c11f2e8f0c76a82c50ec

SHA512
4e54996fb1ca94a53d3f251db593604ed271fe4582d2a5a3ee7487959c51ae82faae98b385a1ef8c8c47dfdb22be2c9909c7b400ebbd0619b9d5ab732d6556f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
890b2445adf9c29829a2a58dcf1e116a

SHA1
00f501ab1323592660251950df727fac4f719649

SHA256
cc255a8774dfeb0ca4defa6d08d055abfac73cd8d22d59cb972bbb25e34391f4

SHA512
c72606d6a9d7d1a3236e7bf83fc20107b94e3dbe2075f4d52dfa7a80dcadd18ed0a12fcc91c2a7f0dd71ae08a1b95952f1f269a6575cce14eba2d3fe2bcc65e6

Download Submit
C:\Users\Admin\Desktop\lukitus.htm

Filesize
7KB

MD5
97becdac57fd42f32256adf2e3eee9cd

SHA1
0f458f928e29bbfc30283d1355cd5cbaa7300929

SHA256
e3099b26d18259741893c1a6123ca5bf0f8441aa5fd8a19d90ee4277b1dea926

SHA512
fbe98b894024543a38ef5f1131146a8945105a1019406963e0a646bcf5b7e307af80a05cae72a97db2d500f43f10da5917fe94c5d08d4f0b56d780f1dd10f7aa

Download Submit
memory/2624-4-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2624-7-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2624-294-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2624-8-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/2624-6-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/2624-5-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2624-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2624-3-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/2624-2-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/2624-1-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download