hxxp://fifa[.]shop

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2023 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fifa.shop

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
1968	msedge.exe
1968	msedge.exe
3448	identity_helper.exe
3448	identity_helper.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4376	1968	msedge.exe	29
PID 1968 wrote to memory of 4376	1968	msedge.exe	29
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 1292	1968	msedge.exe	86
PID 1968 wrote to memory of 5040	1968	msedge.exe	87
PID 1968 wrote to memory of 5040	1968	msedge.exe	87
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88
PID 1968 wrote to memory of 4400	1968	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fifa.shop
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd15b46f8,0x7fffd15b4708,0x7fffd15b4718
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2623054188764276086,7159281200906684865,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
182KB

MD5
cab0e0444bd6133e149f009db7cfe861

SHA1
cdfb64946c4ae4f57fa8aeed63075808883da118

SHA256
293ab5d7809d40381acadfc942293c957e44bf1a42940a23bfae843b3c75fac4

SHA512
97b287250f8cd0e60b0d890c598e538f4d0b30f174d1a3cb60c628da36783d302cf3dad9cb1f2af27a9325504cd46fdf9755249fa92affa5e54988afad6acf2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
939c52b41f6a1e6eefdecf22d6586e8c

SHA1
f24ecab7f48e563ac47d2878868427459026ad2c

SHA256
1528a50ac8c2923c9ea6dac5f4276a5168fa44d9a715da7db4acad4aa723f3f7

SHA512
4aded7f937675673a5a2753efb9f8f3144fd76c435b819eead84c54ffcc82d87a222037fdb14df76f318c2c6ac62d4fdff1827a2be25afb46ddc8820a152340f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a11b52913600f8b5285910fb2594bc4e

SHA1
03bc171793c10467e6b78ae567c8d039d1e1fb58

SHA256
b5b0efb3d19a48c28b1ce2eea17192a384fc3af33f770939de8e5ef26b06676d

SHA512
d2a9d64c79ad5fbeff72e94ee4dc656daa69ec510db78bae2226012695093c9e209bb3b7aa277b75634c188cd1259af18660c65dfecc6ff31dfcf512757a98ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d03bfb1d5d0b9a015a1cc14f81ec8bc

SHA1
1cbef55df5895bc45506c4fae72dfe409c10ca9f

SHA256
2f26e5c58e89e25188d4069cf289c5e862d9f491b7c80e014b455a6b3b04f3f1

SHA512
a4827108ba8b290b2dbeb75e947ebde1b1caef4dd8d16b33567e1f3b7a969934e74588fd4104cbb029efdb63de10bb6b2747a8762ffac1e9c63122a16baa444c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe3ccf39c8f36e67cd4e2a5833c61cc6

SHA1
9b403309cbbaff79a18268a44e42dd483af63c97

SHA256
6438e2745a636d41d4397f170d1970461381006bebb6065beb381b825a1756fe

SHA512
3a1bbcfb46e5fa7dfe601ee4cb340999002744466e2a7e60cad8e7d2269f6094836efe00df7dd1c853f24fa019c050790d0f6a0bd2721b9720c57865262d70b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
774021c1656f9f8fa95edec8f4747c7b

SHA1
eff3d8f3781f441843643873500d6f9d002aa42f

SHA256
ca3af297dfe58b8218d7d10459111c35f46ef896ed89199c098348e06b5aa17b

SHA512
2ed1902ba815d8b1bfce9436a593cbf7cc68b9efe0eb7d17f52b4502c9352435921080fba225dd4d9270270500c2fe56c72988b23432415bfc83477322ba1d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db0e.TMP

Filesize
1KB

MD5
a1900647ab29fa3744fe31fea077d8ff

SHA1
7c1e9e52f96e8392c5a3620e0b395c8561e285f8

SHA256
c31a9143f59566ba344894ea7d6b89dee57e13ceba0583d9d9d05351bc2c6169

SHA512
1c7eba23b9df89a7af13a1dff2eed2ee1b97c76830ff9aafc95be158224e7f3f9e62d88abca528eeebe00d09b806dcdb7a4d63d21987635e7f7629a9e1e49be0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
37a45963fc80f13f4956c53b622049c1

SHA1
8d664dfbaad18ca4eed8a589cb48a598f4143c50

SHA256
b67fc277814815f93f7d31ee3fb204f6135f04cd0cf9a6b3bde7ec6f0ca22159

SHA512
ba55b349aaf294cf6f8bf39bb8c0fa41bd9c8f5aed8b31b7a21c55a0db675fa670e6cf2c2e44985a5964617ffa9549911c90da2752bae7343bb39baec728962c

Download Submit