hxxps://galaxyswapperv2[.]com/Downloads/InGame[.]php

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://galaxyswapperv2.com/Downloads/InGame.php

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
4300	msedge.exe
4300	msedge.exe
1088	identity_helper.exe
1088	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3416	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3416	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3112	4300	msedge.exe	84
PID 4300 wrote to memory of 3112	4300	msedge.exe	84
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 2472	4300	msedge.exe	87
PID 4300 wrote to memory of 3572	4300	msedge.exe	86
PID 4300 wrote to memory of 3572	4300	msedge.exe	86
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88
PID 4300 wrote to memory of 2088	4300	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://galaxyswapperv2.com/Downloads/InGame.php
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9684846f8,0x7ff968484708,0x7ff968484718
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4120 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13945161428095264389,15841455465979405727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x344
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
640KB

MD5
13025407a1289ff2c9272b5af42402e4

SHA1
b3217b74002007b2502692ba58102cbb8d094cbd

SHA256
f60fc820d1f8bb773de640b27b554badbe255e35e7355b26f15f388674468bb7

SHA512
7662a71c05c7b090e49915591405505ea2cdfeb84bfec658623c2b4bdc4cb409596d60d2e4906776e022c18e1679fbe3d9854748e6bb5a6ca53b4de2db137a06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
1024KB

MD5
88ae376349a1a947e8d5c0639248cb8d

SHA1
51fea68e0a4b26d93c37d1b58ecf4db157f25172

SHA256
6d047bce433a95b01771aeceebed8838bc310622b558a011885b9412601e3750

SHA512
94d8ac823c623dba15ae1df4ea299e456a0dd9617d52e8735a6a1605b641f44d7b5357e7f24c80986bd5af42547d3e31eb39c8d2613f92886673818b3c154cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
1024KB

MD5
9927c9f03f688a4c600941b4475ecd09

SHA1
1ced96bf828167d9b324e520186ed3fbab70eea8

SHA256
9852105cb8608d1af83cdcbbf84c318cf6844a062024a644d50d590bb7bc41a1

SHA512
3345cf4fde6c32340db0a33fa297effa06413ad759592cb64909cf1b415983f8c71cc4afe1977a79a7f6e51347189a42375cc7751c249d8c8d3d6faeba922e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
d95c51e9aa52b311dceba0f2d172069d

SHA1
ef090053b5ec9f2919111b2e90d583c93cc021b0

SHA256
d5eed5a242733e56b80ea2b8720894d2b9676fb9978f110b2734822d752a6c41

SHA512
248d50f6243ed376c727b037367421c55d52e01f7fb81f8e54ffae235fee184da3272e43fb534340f5fe80dff79a43502b58240fa39339e905e824e5df1c5179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e5a6295e4ec8033792edd343dcf5ed0f

SHA1
7ef364c2100a5436d8f23bd685f2b4568bcbf793

SHA256
46ad89a63e7a1d572c31b062d49b53d49373365056a0a3af2183677c824bb49a

SHA512
9e4537abcda28fac11bdd5e4da63c5032d49cad602df55ee660cf86257b7483e0bbdbc1bbf733e912f1c3ce41664d4bdf486c15e923f5775bb6cab576b546eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27225267e3bc687095a2a65409bb732c

SHA1
3b0452cc8b5f3402e2321bf96fb76b5da2f2955b

SHA256
01c8ad0ac425ce1be0d9c509bd6578fa561c9a2d9867a8b5904c3082223f932c

SHA512
a0e249c3a5edfdd3f13a6f6a0df3960eded22dc303fe9d146357b0d1162c05b958afd63e7dd6950e8c5a7a707a79838300c5e6e55ab7f0cd657fd9ba436367a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef5001040c0b458e6a336a250e7605e8

SHA1
522b1acfd164bc4d69331a36cad0daa51d8a13c3

SHA256
533c6a707c37acb0085f16d50683aefe16c6b3a3d18f20e6081cd20a357295af

SHA512
581c6902eaaf2592888268d3eabf7f305b9ba8ae81ae4a303921e320a2c31a8d5295982d05272fc520043176f46918a965073df2798f575e1624e1d736642936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2fb8f50d8e37605f0b46e21d1dd8478

SHA1
3958b0761049539583b68bc3931349170f8f012b

SHA256
034e7c2c3e7b64f44de969caa06c734132f66c4740a832b5b78cfb4d33691d1d

SHA512
030f33a7d34ac4fb71f36875a302637ba7e399dd5cc2e8fe9a538042e15818ebbfc29a3fbc10602e9ad8b4af8c3ddae4c124273361069d4e547805a3d97a38b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95b389143f5de40e447228026dd18ca6

SHA1
001757a7913fe2bedec11152c601cae8d68728f5

SHA256
4c90260acf5e0c01c58bfdbf8c460c6dd32a56e6de798f1acf9a55a46d5da9a0

SHA512
43f21f54ceb81e5d96160f026148889e83a9bf09b98988ff576e5e42f41c935b9919c0908796a18aa7880f46cb2cf6520a11922b17be4c37e0941f71e7705b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5e9c7d270b8edcaff56e32179307eb25

SHA1
1f7ff73004b3c89b298592c7092b17618248b92f

SHA256
7872636c12d2f356f84847672c4b48a66b003856746fabb1a99c1ff6703b1fab

SHA512
b2fa06b09fabcd883435dbb10bbff7392d43bcb47b423a6a1097961a47b835d900810c8c11f9daaa3272b4e8c1df38bcfbf24a2c4c06218fd4ecbbff492d63d4

Download Submit