hxxps://gravityparadox[.]blogspot[.]com/2024/09/gravity-paradox-is-pixel-platform[.]html

Resubmissions

18/10/2024, 01:27

241018-bva8rayaqh 3

18/10/2024, 01:24

241018-bsf18axhpb 4

Analysis

max time kernel
109s
max time network
111s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18/10/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://gravityparadox.blogspot.com/2024/09/gravity-paradox-is-pixel-platform.html

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GravityParadox.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
2708	msedge.exe
2708	msedge.exe
3704	msedge.exe
3704	msedge.exe
3848	identity_helper.exe
3848	identity_helper.exe
1340	msedge.exe
1340	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2784	OpenWith.exe
2880	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
1920	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
4464	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
2880	OpenWith.exe
956	OpenWith.exe
956	OpenWith.exe
956	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 748	2708	msedge.exe	77
PID 2708 wrote to memory of 748	2708	msedge.exe	77
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 4068	2708	msedge.exe	78
PID 2708 wrote to memory of 3808	2708	msedge.exe	79
PID 2708 wrote to memory of 3808	2708	msedge.exe	79
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80
PID 2708 wrote to memory of 3432	2708	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gravityparadox.blogspot.com/2024/09/gravity-paradox-is-pixel-platform.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc20b3cb8,0x7ffdc20b3cc8,0x7ffdc20b3cd8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1712,11605881144042297134,12153172099564889525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1260

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
392f7d9686c7d14f4900e593f00498c2

SHA1
3f6cc1e21c9039bbf3ad7aa016cfd35589513ca3

SHA256
21536c8ecb5983bef796e8d6344d9597706fec8f376131e414c8514cd4c4423e

SHA512
9aaac8ec2d8350bfe33b95747da6de772f221f3a54049184b03eeedf8e7dc81bc2cb049cf9fa94ca9f0c4a2a35b6d4f00ab6bcfa5f7a77d52a902fa224ebd09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4069b0a2085fc046e739875a1c8fee34

SHA1
334e56862e3e9fb4f7cfdb90cfc9d535e61fc52c

SHA256
8f97c6dc232d50f276319152a5a9b875a20605aad4a88e6a7032dee8f2e89fec

SHA512
86ff4114dd45921a96b07ccc432e49bd99d80f46a4bcd2ec57be9ff307cfdf39d3fc2d1e3427e450645b2933bdb52a42bb883b0df0f025b7db4c040942ed8f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af347509752444adede73e4ff5344592

SHA1
7818ac89b1e47bf2cd3f1884b74f3ebba63b7c00

SHA256
989462cd57df6a3abbfbff463a131d2926db114a6cb567407d267e1ac0456259

SHA512
14542737a3c2aa583031cdfa70bfc5fd5532e7ad5e02e98fa7aeadc63813c216554fe52cf311f42f28ac8f16fc62d2c8544a331d02a0a46f36c32fae10e0c5a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3376a1541533aea04a03072e8a82855e

SHA1
5a26127d535640e9301e6bd64fe3b09df5e7eba8

SHA256
11421c3a8f9b3aa73c333aa1bdaed5f3bc6d65797aa9dbee510fb30bb0bf3094

SHA512
3d24ae5c6924415b2531a03461fd730a4f606d9010e335ad949fec0255843cda8b4204efaec81c2be0910708ef3ba4b5179c3ea66d383213ad79a8aeff344298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcc8758fe42c14ce1cf400aa0c399bf6

SHA1
0ea669f7e9ba563449e599ba855e8d8526c614df

SHA256
8e0f1eea82ce383598ea6abe97e520b06f5c5248e1ec8e42d6854a55bf9d732b

SHA512
1b1d5ca4f8f84efa2f334687769a6f1579731a6f695793f47838cdaf330c1b9751ad859f05dabef32f32152c6f69cbe0a676f73a128fec3974d0bd1ac56e0f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4e73c38e171ac7d2eff5420b9c81d79

SHA1
0a45c003aa008bcced57ebd49deff4b93fe4b5a1

SHA256
746b304196af4e0a8ae0160b876e7c29330cb96fb17aec359997c400597a9b1a

SHA512
d89438dec34c2e853021e7b0e001f1a69656233c162bb1a836d40e4a9e24c77ac0633902da630c6c04a46cbf8c9425f9d510b31e074d3b75da6fa94e03a11186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b866d7f9987b0daf7ec26f8d149fd2c9

SHA1
c59814e199814e2dedf1b2832e3b6b8aa3188c08

SHA256
0c9386f69176c0660f5e97c6c9a4f25e8a10ac0e845acbf525379cb8d8d762b5

SHA512
6f8caaa20ca2c75d26e9ddd8aea4a6c90c67159d3f3972fdbd6b46bfef1e1e7b85faed97932bc1fffaaa019248341ab0df291619758e725b54cbd1b4fc26df1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea975abf58b65f958ca6d376094f093c

SHA1
193d6efa7720eb85d3e570d90314beb350e79402

SHA256
90f05a18e6efda38877a59c28542163312547c46ddea52c45c621b07d45fe25a

SHA512
3ec5815f19acd3050cf5e8e26c0d825b65e7eea7f7fb55eb181e0d0869f8fc4693eb939fb94c6bd844525a4407d84b2b28622086bb7fbd06fb1cc162c6a99b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
91785bf73c4e2a463022a57c052a8476

SHA1
69078396e6708a5bbb4fbb537f817e8132db39b5

SHA256
a9d342a723f80cf23537543bc3d1b162641f6471456e69164f3876e37ff18933

SHA512
e827dd7e4addc2a9e4efbe9d9ef69f5b91cfa9bffe4723fd29d807a252dd0208dbc0a21f5d4901ec292aa6ee070c2524997cac472b2e073d268dde727c78da4e

Download Submit
C:\Users\Admin\Downloads\GravityParadox.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit