hxxp://shinolocker[.]com

Analysis

max time kernel
1680s
max time network
1685s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://shinolocker.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
3516	msedge.exe
3516	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3612	3516	msedge.exe	82
PID 3516 wrote to memory of 3612	3516	msedge.exe	82
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 1272	3516	msedge.exe	83
PID 3516 wrote to memory of 912	3516	msedge.exe	84
PID 3516 wrote to memory of 912	3516	msedge.exe	84
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85
PID 3516 wrote to memory of 3360	3516	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://shinolocker.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9544029005666249369,2548772987530506626,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
a7ec0752c460411664252d66ec0073ee

SHA1
3ef99e0bbe9e61731a25470a3eca40e1154e0b49

SHA256
ec7ebc1c67508adf40bdc99c4e2b0343d64d2117230d7ac62161ee431c634250

SHA512
f90433bd8fd5c8511db2f4aa4d6572807ea937651aa1090411640f2ee07a5e772e9bb1f50cff9eb08e3cec44e81e99b0234fed34175f5300d853b9d018f4d89c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
57deefce2fc2ba6c6dcc68ca3c9408ac

SHA1
27de105d6f382ce106bfdd8aacc67c4a15aee81d

SHA256
669f7279f3e1adf4982d3cd43a01050b397bb1ea0305bc610f80ff72a4339005

SHA512
c8fa72223181038e823335e8784e73c94536a467f8ace144dc3ff77ee614e4233f574f77a5fd51a1624003c7ded7ec6cf39f503a9cc564eab10bbe91776e9a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
52ba72549df2e8883fde468edc37028d

SHA1
31fe43289f04283a863dbd07e9e5ab609172c9da

SHA256
88e564852f0e584d5d57aa1d0a2f2110bc6a0155c167675f4c1ba7b2e0fea122

SHA512
fb515c33aafb26c07bb6568e5db3a99ca8c92e26d82c1967486bbd38925454aba99aa617433bba587a899aa987b217e89e703e8e6b3be8a77145015cbc96b146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3556955c7c9b07b33a9bbacf4bc2ca6f

SHA1
a36dce6e95378001d5d8bbb8146ea09ce22fc350

SHA256
99aa156ccd48b2417034ea2f5b2389891185c546ef45698c44aaffe88e207896

SHA512
0e6ce078652ca3354e9bacea07473223288010801911d0e6c8b312baf026e83177b50d8f4d4f22570c30342744fac8182e6a9e85618bc386a32fa6ee281a7d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b4581d490ecbbbae31e2a6e0d17d17cb

SHA1
4b94f92d5ae74a7feb26b185e2ed29541c28c1e5

SHA256
abdef26d4ed2d706dc5a5953f0a5a085b2c1182af7574a7791354a76632f175f

SHA512
9b56a8e70beff9303ebc5a21cc4575982b42dc152321a4be489c6917505844f974cd06e45d367f715f7c9b841404648ae7305d915137d27a71af5a0e00eba93a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0143901b64b969d3d19546f6dbceffd1

SHA1
c588f0efbffa148d7b85071883b1e41653252253

SHA256
1eb98751a4a3fdd5e17f7e329f132ff644aa88facf711a573463fbec2466134f

SHA512
ac8b96758d9eee5c193ef8641342f33f4c94179846e7933c477cf02416bc7dc2f5d7a241ab9ab9878a0dd5dadc01eb04e83cf8bb6a78e160a7121a81b60960dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9f1d20e66fb908784c8d475c4e34de13

SHA1
736944ba093486e0210c824590ac8e1134eb4b1c

SHA256
3f7d0cf8c98a767b21ed5f6698b2d89d53f93081d3a797f2bfe4a9a1392dbbb5

SHA512
6aa929b44888a219ee87919588c5f5437846d312ba390d735cc7e3ae199f05bb185c199e8316355865ed662c29c3c7d5d2bdd3f205ebe5b0636602c4390b0326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6852e4b7f2f54624461e748873fa1a25

SHA1
832b6861e81c7fdd7ee271985f19948137526318

SHA256
976d72421398c250745d1d7bcc0e050374c52d353c0f1717f190f48655ef0d83

SHA512
b798a877aa7dcea86ccadc10e998666067139d379a446f1a5a7a9574901fff2eac36bfcc4b2443e642474b510df3a67ff0e5fe65ee1d7379dcf4baaff702d288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c3abcb996f81cb25f6276191fe5d8873

SHA1
56cba03b82bc64433f9185ac4c8c6385420db854

SHA256
dfa5947db7a7ec2105baf3539513d81e40346740b122153441df28ddef9cef26

SHA512
5be9f51fda9708438b04c70b3d8d29f407921b5fb49eaaebe491de2fcf9c1ae42516ff700d5654f4288370e794bdbd59b5e8746c2b3469d1d019604638727bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ca5e60b90ced6215b774950b4fe7bc88

SHA1
835b04f9c7c5bc148c51804c5eed5f9a4b191354

SHA256
81c2e74251c5a72420b0a7677efdcc5978bbe675ecf312fc514ae19bae311a6c

SHA512
f7ac993371327dac8fbf6eff7dbcd8ebf6dc08ba812452e3724401412e9ba8f71857031b5ce5c3a81e7ada0e023633aeaf83d93e83e5d6ddec9a6112d6aed245

Download Submit