40cf456c91eeaa9dcaa7e13522397c84fe5b892c209aa8c649f28e8c0bff6f16

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe
Size

1.9MB
MD5

a62f63d3ef60ff9592e70a0333d52b20
SHA1

c246e1975ef717347e92b35e3912963398955173
SHA256

40cf456c91eeaa9dcaa7e13522397c84fe5b892c209aa8c649f28e8c0bff6f16
SHA512

273d1605888df1e72b2d4a535530c3578ba71bcf44a5fe1a205b4ac8ffaaae64abfea7361777a56acd1316c0fd8ddfe18924435971ab54e717105d1926953a78
SSDEEP

24576:vDTdeM9Rw8bSsiIRq8kf9BX0VCOMgvl0gtYBUZK6EE/5uUZK6iUZK6B:bZeyZ8XX019JwUQ6luUQ6iUQ6B

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1960	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SouGoo.ime	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Hook.dll	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
664	msedge.exe
664	msedge.exe
3852	identity_helper.exe
3852	identity_helper.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1960	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe
1960	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3752	1960	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe	87
PID 1960 wrote to memory of 3752	1960	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe	87
PID 1960 wrote to memory of 3752	1960	a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe	87
PID 3120 wrote to memory of 664	3120	explorer.exe	89
PID 3120 wrote to memory of 664	3120	explorer.exe	89
PID 664 wrote to memory of 1068	664	msedge.exe	91
PID 664 wrote to memory of 1068	664	msedge.exe	91
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 4276	664	msedge.exe	92
PID 664 wrote to memory of 5040	664	msedge.exe	93
PID 664 wrote to memory of 5040	664	msedge.exe	93
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94
PID 664 wrote to memory of 3572	664	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a62f63d3ef60ff9592e70a0333d52b20_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\explorer.exe
  explorer http://www.huniug.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3752

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.huniug.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff5b7b46f8,0x7fff5b7b4708,0x7fff5b7b4718
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,5853247325162598276,10128061736222655266,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5624 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aaea5d59382bbf6b3dd4fe95c83591f2

SHA1
00d3497165fea21dfc0fbec56f3cba8c205bd558

SHA256
92cfa5b4d04964aeace091cde13a0884ce61979ca29f07206c699a591b20c6a1

SHA512
0258b03ea06273a94b1af335ebedd82ef12e7581bc8087768ce91e35fedeea6068dfe09cdd7f07e093d1cb48b4f97404f29d82559feb9f34424164059d61aa0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c01dc681c292763410f581bc888222c8

SHA1
8abc11ce948b9b81dc6261faeee55e72db90b9a6

SHA256
b5ecd718bd7414f32fd203f9d26f09cbcd1a0e968e4e736344af32cc0f98b655

SHA512
649dd3adb440c8c9da226d3bbb785da8058ebe60cb8b97a03bfc2608036789c8f5e7f27f3a250fc0fdf41ab6c3c41dcf6ecd552c8a1f13ca08bdcea6c15db74b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae481d332fc67e0af917fedf0607d547

SHA1
5b3a8ab9af8256817ad9dc6cb1fd066dfe8558a3

SHA256
698084775f51b07e191cbac222ce36826b223b4ec93a0faf801d75e2f69a5d04

SHA512
75280f18017c229a7268988a0807f4ed4e0c9115daf47d945a2c4a06feddcd1aee70a895d11ce9e3f15bd523fa3be4dad1a8df433271d32e79043e70fed8efd4

Download Submit
C:\Windows\SysWOW64\SouGoo.ime

Filesize
52KB

MD5
b60da4e2e5aceba3ce3d87ee2cd872ee

SHA1
9bbdbf1f3ce2c000a86e0473da756a4b1031db41

SHA256
b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453

SHA512
664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874

Download Submit