fcba6631b46e0e12601c371b19d1d4a3c8209c8b70831e548f23ef89a648dc9b

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Balatro.v1.0.0L-Unleashed/MrPcGamer.com.url
Size

120B
MD5

c461dae867eed4072211cf709fa70a20
SHA1

2fa5ce6734f5edd0a213a5b1c9e4f75d3160f3c7
SHA256

2930c58a0b49ef48370f91801e37499f605aa396169e776f78fa7d8b9445f158
SHA512

501e0ddfdbe64331941e268a5362ef0a66f207f442f7341a5e5cc1a1a84581d7f3e610fa52ba06a3cca9c09fa061d01b9c4e3b17498e5228639c2c3dbca12cb8

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
66	discord.com
61	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
1740	msedge.exe
1740	msedge.exe
3604	identity_helper.exe
3604	identity_helper.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1740	1652	rundll32.exe	88
PID 1652 wrote to memory of 1740	1652	rundll32.exe	88
PID 1740 wrote to memory of 3256	1740	msedge.exe	90
PID 1740 wrote to memory of 3256	1740	msedge.exe	90
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 2836	1740	msedge.exe	93
PID 1740 wrote to memory of 3384	1740	msedge.exe	94
PID 1740 wrote to memory of 3384	1740	msedge.exe	94
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96
PID 1740 wrote to memory of 2804	1740	msedge.exe	96

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Balatro.v1.0.0L-Unleashed\MrPcGamer.com.url
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mrpcgamer.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4b4d46f8,0x7ffc4b4d4708,0x7ffc4b4d4718
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2146745681829787614,1370696694757725510,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4216 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
38304caf7cad99f738a3af6fb0235b20

SHA1
a22dfbd04ce24d0c18da7c7a3374612dfaf1a236

SHA256
5efec46fc0229031fd4026c5dae028bb043df9e93cd0fca3b7dc68e32c18e2a6

SHA512
46ff52b9a880ee70825c27424741d7f595fe698f98cd43aa1045c5752c1d24cae93b539cf200c71d45d15593ef3510610211a8438a5e61be59136f8d099b6253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
48fb73dea04b5c8c6b1aa8a8ea90bbb8

SHA1
eae2a33920ad7cfedcc5b465857ae7aa3414f44e

SHA256
e7eecc15f119c1ab351ff4d2215458478aa4c69063f2ff054640b5cf0a4f9dac

SHA512
ee95dd2a18e76b89a5d0951991cf22fdbb6fcdf8ba7690cdef78c2cc0982aec5219d3aca63b99ff81e94b5a288a639deb80614e2b9d432a05fd2dfe653773f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1389e750d43a727a3b55cbdb1c8ddb3

SHA1
87b1a6e97756ad817b2844b21ce1ecca17db8bd4

SHA256
1da4d248252e992b46cac2185674232a73469fb76e28eb0911159a8855af7507

SHA512
065a64eac23afb2735c25628811b104399cc26b54d474db30c7c38131557cd893b0935ed14558896484a8c975fe9caccb0cbf02c39ff38a34e59c357e53b1654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b373f6f3258ab871a5d89d17a90d1d38

SHA1
b0805dd3e943ad49810998e26d62cfa5593b0760

SHA256
450030d061fcbf957bc390dcaee4060f8377f457944fe79782b2d9974959e007

SHA512
0bc5a5627c8bc516807838b80544e860e2b90dc4cebbcbefbd01dcd2536e1dc4fc6bb9d5feb17a322d5c4171f38c6a6c8cc69fb24443de01663ef0b0149a0d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ffacab06a727335af319ee4249c93957

SHA1
4bd11ec4d6358801c7bce47acf09a6f89320d72c

SHA256
9e35997d9b0d6d92e3544c77debe3c3a37f157e8151420de495fa757446b546b

SHA512
487b419e917ca84ce302566a7a8504c55201730d89ba7f2e075fd25dea05332aa995ac6c716beaeeb3d370e3ef9065c13211e0d7da233f1e505e0436408036f1

Download Submit