hxxps://www[.]breakingthecycles[.]com/2021/10/30/understand-brain-maps-change-habit-change-your-life/

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.breakingthecycles.com/2021/10/30/understand-brain-maps-change-habit-change-your-life/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
4708	msedge.exe
4708	msedge.exe
4092	identity_helper.exe
4092	identity_helper.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4292	4708	msedge.exe	23
PID 4708 wrote to memory of 4292	4708	msedge.exe	23
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 3488	4708	msedge.exe	85
PID 4708 wrote to memory of 1284	4708	msedge.exe	86
PID 4708 wrote to memory of 1284	4708	msedge.exe	86
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87
PID 4708 wrote to memory of 1784	4708	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.breakingthecycles.com/2021/10/30/understand-brain-maps-change-habit-change-your-life/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff918ed46f8,0x7ff918ed4708,0x7ff918ed4718
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,18407069349587958015,11138524014437230863,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
186KB

MD5
740a924b01c31c08ad37fe04d22af7c5

SHA1
34feb0face110afc3a7673e36d27eee2d4edbbff

SHA256
f0e1953b71cc4abbffdd5096d99dfb274688e517c381b15c3446c28a4ac416e0

SHA512
da7061f944c69245c2f66b0e6a8b5a9bca91bda8a73f99734dcb23db56c5047de796fa7e348ff8840d9ac123436e38a4206408573215b7e5e98942ea6d66bb7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
e4e9e95edee48dc6b01059483e235cbe

SHA1
b3033aa739f97696471a4bcf20d185fa0e255b10

SHA256
0d9249b0f697de47d320b93150a53d0cb17eda17f51f98088b7c114903f8f1e8

SHA512
1ed90de20d7abec8746ee8616c38f57b08c7814b0c8b7010295f97e8cc4a87d51cc8ce04400a7e0df89d9e2c29aa1d6c777b52c927a42546fe700edd117b1308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
002b5494cb44f9cb7ed627aa3d7d9f30

SHA1
a890457f1e95d38960f487da632422e1c06ef086

SHA256
482eed88866fbbd94f860c37442dccf341fba0dc93c5eed80dc7584e824bf7d6

SHA512
3f78c7bbf306fe673dcb9a382ca91ef19d9774e0c6e66487b9614c77eb9bd92f297f32b4d1592f4b986d616b4f8a9179b70c293ee2f13176434758a0231dcfcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb0fcdd95798a569969ba9ee38445c7e

SHA1
fcb338ac65bffa4de9283cd2462bd28a0f8a7a94

SHA256
f034f2976b6a043ce5844223e23ba7cb8939ba27293a3ad323e4c15be0226010

SHA512
da77b6719fb097f3376a89b30e2e29fec6d7973a2832bd5f2884cd77a701e5620a2a822c840bd9806856e121941e4fae48dc0efa3d9b1d7762b07526c9ac78ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0d9fcc02d3834aeae23844b4f88d2e8b

SHA1
c4b8dca9a9f40ce84523b5aa1b9f738f1c155fa0

SHA256
2fabb0f4b6fb34b6487655bb7a5cdaac2d14b1a1e63a1dda21eaf985838deb88

SHA512
284c612f2cf86415f81c193e3f276b2d92cda7daba1ffdccc42dbd2251802aebdd346a1b80919a99b53c91b87cda3346303f1ea078990dc5420545a079245fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
91844ad62accf205b3ce4757c61304b3

SHA1
e4b766de5b618d01d1c961f5e36c267320d5ddfa

SHA256
2a457d54e3cc620e9bcbdee957e8c6c635a8fad98e3329ba6038d669fceb54d7

SHA512
d562db6d4422bd9fba85faf5011d2271194b6cb5ecf78b82066d45c212183dce8a4e0141a75311931a4c1b5a51aaab78417814ce61e78233484eae1be188875b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ab8c42208c99e95bdb99c83f23f0b6a6

SHA1
df87026f7ab38b4453917b4a2255f3587a842a39

SHA256
14b5eeb6751707eeda78ed35492cfbe73e524411f3c002b399f9f73d1c4c76e7

SHA512
41d18b6434ace0b9efb45380b49e09659ef0734599dd28ee106e2b71842554eeed4a18857d7b65a8aaa89323b131a1fd5f9e278b1cbd1a93bc34e2c2f8eef113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7147a7845db19eeb7469c59c3d95a8b1

SHA1
3e89891375d17ccc88867cda88ae05ac184697f2

SHA256
8d0557ef2aeed0d3b0c5a4c5f27ba08ab43cdb25e3772e75f996016d61dc75f0

SHA512
ecca387a63d4e963270406fe536f338a36e9a3b9c09a9899d361f0d7dce02a92949388a878712ab7a91846eba166c14224a2ad29cef02ad27dd6483e64874567

Download Submit