hxxps://forumbusinesstravel[.]us16[.]list-manage[.]com/about?u=22466eda61a44e9fba3e57cb2&id=1573b6a76f&e=da8c39f210&c=564b13b6cd

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2023, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://forumbusinesstravel.us16.list-manage.com/about?u=22466eda61a44e9fba3e57cb2&id=1573b6a76f&e=da8c39f210&c=564b13b6cd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
3388	msedge.exe
3388	msedge.exe
3660	identity_helper.exe
3660	identity_helper.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 548	3388	msedge.exe	9
PID 3388 wrote to memory of 548	3388	msedge.exe	9
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 3232	3388	msedge.exe	89
PID 3388 wrote to memory of 2256	3388	msedge.exe	88
PID 3388 wrote to memory of 2256	3388	msedge.exe	88
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90
PID 3388 wrote to memory of 4932	3388	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://forumbusinesstravel.us16.list-manage.com/about?u=22466eda61a44e9fba3e57cb2&id=1573b6a76f&e=da8c39f210&c=564b13b6cd
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3e1846f8,0x7ffd3e184708,0x7ffd3e184718
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,2184337371488419997,17815718535766341445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7bc4a9b4-b1ce-45a3-8982-483d2cd52394.tmp

Filesize
4KB

MD5
9fb80405cf1543c0ecf1669f66e63050

SHA1
486c2f18af4f3dd3fdf06b66e7f3874b8bd703c9

SHA256
2c5d347cf65f2dfc6a3f097ae67a7334ed1a3605c2fe896da88cfcff7a5398fb

SHA512
32a4a61f103e9f1cd2478e8e82289af182e62086342ee39817ad6443c60aa0b867e550c3618e4604398d0d1c25b32b18bc2ca45f52e1393d44c88076a580d0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5a4c6badd2d2e8a3304abb9a11472de

SHA1
e828b3d3ebdb7c9a0614a8ac841ab37ab02f43ff

SHA256
91565214f61d724e6cf0fc73439df2305bbed1fb0845c2df4e0bac7c6a9ab5e4

SHA512
5f1993419ead73faee9ab644bb8fe3c395e185d4c61e8e7fc89c675aa5a99debdad11415c1f0797f0af53598ab56d75dd934f395fdfdfe8a0646c67a20d99d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
050859785349c280f62d40ab8c3802a2

SHA1
43f31569c2e17f420c974de7d9fdb5f3b8271c2c

SHA256
768eab27d4d54f29dd5d5a97e9cdadc02f793cff8a9b90049cdd2306d4c629c0

SHA512
9491e4a0bfb9ecb0066899a4973c24d48fe231bbef68de4d212556340369cea5184479c219f9a5e9b04b0b804cb3e6fda1cc7664f7e2fa7abad0dea0a5e7d96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c6e07c03d1cbe89cee2437dca74cfea

SHA1
330cb9484efdb76c873b872db8fedb4671415311

SHA256
05dfdca1b8d9550d09649158951815dbbc3247299fedf2ffa4a643298a15b28c

SHA512
533546ed20fd8b044009f7b9213e54d16302f3a138e0992a0be4348d63d7c776dcb9233379676b39d6a9c0d7f987b856c9f5c4ebc98fdd46e839b19a9ff04739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
7b15635350eeb71e8cd72c60285378a9

SHA1
fc4f2c94d9db768abc224316112cded85be75dfa

SHA256
1c541fb7f526df7e35650a55588fc6dec1c395e7e2826b4c826e0effb8035376

SHA512
685c66ce372c00334a291128ed046fcd73d84014ad5e63afb8955403d7ead832f1ba52cc11301d2d92315f9f3ce498bda9c5004ae5e2a0a955083dc269f660c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
a089c4f60db4284b4ebd155086b5a971

SHA1
18ad20ec7891b74791c8016104c96f8dc2f07f3e

SHA256
93477327d2742d147678019d39f26907f136a0cc7569bedc461b7d99cf8a2768

SHA512
49195a09b7e945aa4b97573883e9a712835f84be58de66632d8569ba0248802b77163194136b9ee818f36c17e72a4abe13178daf849028fe6ab1c766b5512dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
773f335d58875e8913fbb2c3ec4a70fb

SHA1
1abdd19505b8f60f6589f25c296802a9eff87c29

SHA256
6c9df467e2a988699fe10a9af97131ad7b26229a3b1e123b8d5bce22caf99a09

SHA512
ebcb303e6c45993325e13366ae94aa10e35159169bd2d66ff4c945d63cc2eae30e0ccc962bb1997dad63328011443d7e7759c39c20b09dce587a1a9d218a953e

Download Submit