hxxps://rb[.]gy/dxgsl2

Analysis

max time kernel
74s
max time network
76s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09/03/2025, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rb.gy/dxgsl2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2712	msedge.exe
2712	msedge.exe
468	identity_helper.exe
468	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1548	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 5040	2712	msedge.exe	84
PID 2712 wrote to memory of 5040	2712	msedge.exe	84
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 1580	2712	msedge.exe	85
PID 2712 wrote to memory of 2356	2712	msedge.exe	86
PID 2712 wrote to memory of 2356	2712	msedge.exe	86
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87
PID 2712 wrote to memory of 2272	2712	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://rb.gy/dxgsl2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff915b546f8,0x7ff915b54708,0x7ff915b54718
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2612 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1982820116476702388,4471685334443885868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
daebce121226e9240bf159744148db2b

SHA1
1734ce173466809c9190d370dabea1d8c145ecb5

SHA256
85941cd73e4f7a05e14059a6d599eecd24fea54cf972ee66fd270bb690858949

SHA512
75a3f910413edf6898574f8354a1df3f2d119026431df9a744906678b23bb1ffd2de462bf065488f656f2c234f8b48e1d738513dcf4d6d85a39993bba2256d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
105KB

MD5
16972e03d2bd4219e478f7da13b187ad

SHA1
31fdcc4d146302e809628b21013a59042e3671fa

SHA256
5315862acf4a902d55dbae7d292dd70616fe9ad76ca9eca9ecc85d776824b59b

SHA512
42cdf24190b588812987201c6c7741ed937a23b8d306324b56a9a07416a8b59fd0b34cfda6b67454b06ad1c9a03b9f99f64b5ecc4f027f8417e4259ecff9963a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
510f62fe92fc5975a7d0cf790c110df0

SHA1
369f16ffc1be13bef58f403d49bfd762b5d485f2

SHA256
f7969f6ecdc76368d0a4734e6a67f47d67377ecb14d62864f2d91b3a732db521

SHA512
5a1b442d6641f59e3a9f8eebd945a12c370971c3ad6b842e39bd775114b9fadb65113987ef89760fb49af96854f7deab5834a0389ec84eb8f3ad8d89289410d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.r.oblox.com.af_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.r.oblox.com.af_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b37cf30f7b8928719a6759c516d928f2

SHA1
477ef446a9defc04ef6089bbad14de7f2178af0a

SHA256
48c24158f6117806922fad921371b9afbea456e727a399ba5085ac2c00a81029

SHA512
903d61ebecbab150f5631f6aee52ef46d0a8acc27a762fd3ce690a53176f51b7c808026253f86455d64deff89b20fcef8490bac8fc2c80964eed0b2e82e8f05f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bdc143c22822deae869b1defb0dd0425

SHA1
2e5872bcf19803dd18db18c8e2c319a0873164ca

SHA256
d18de1c633a557e46c201120c750893d9882e09848e58ff0fa594f1345d90d60

SHA512
79e160eb45b56ef0198013ac68397d72f887924487287c02260197b435bc17ae6f60c8ba592027a988cdd4795034dc7ea4e0d80018bbde86d19d41950296f413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a25efd5513d6eedf876ea66bba430ac

SHA1
464c64d4f3831c1ef4ad834916d3f0a865cb8d53

SHA256
427dc269c71fcb0ada7d518c9ab733c6c6aea00b0617cdeb48139b4a119ebd36

SHA512
6d59f4f049f0378e30283ff2af1b3c6bda11b11752f5b600d495b5fcd31061e94805d9ae77cc2f467ec764c4770f377d70e22def69e098ebef998b869793e95d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b759a282f053d6db4c6f8891655d37c

SHA1
d9ac22341ed1ddc122a3bb9d0675d14e15f7949b

SHA256
332b19a81eac4012b103c278e48d71aeda01ef14f232fb0a95f7ed029a1afb87

SHA512
d0850cd4dde040adcd3cc225321a271095acd33cca05938dc117a49e6333ad4bc16c9d5ed2e98bc9cefdd9e9fd503cd843407dc10672f1aa944d750a360f642b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b91288d5d5707d197ddd38513966619

SHA1
8c1cec9fbf2ad16ae6709ad199488e47257d292f

SHA256
f27d6863d4f7fffd23528121d5fa2d5e0f6598ef0d7fe141cef1cd132117af02

SHA512
371ef11f642214eb54ae1580504f2f2f2138ff0624661545da6127cdd61ba0ed47f84963f77cbf9f22d68e418178d318dfc2c3ae5d12343cc74d02e25468bc17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83f5e49883b26ca2ddf674ec6926e083

SHA1
0a95ea100a50b91ba41e26955913b26cd39da23e

SHA256
74288ff77db8553148b4b09084090584a623176edd170efca7792a8aeceb01e9

SHA512
e90f9b5bd530c353a45ea6e24680ae4e12b2ed5a788a8f01ca497772f87fe076241e008e9878caf10f0167bb9068e49c17461c45d6219e382b2efbc6fd46bf0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d36f9abdbed2b3feceb2a60bf77bed0e

SHA1
334d7848650c2f4c489f0336c2d01d76f8ee6dec

SHA256
1450d5f563e0e10e5aac3a09a23d73eb1ebdf1051882df82654d7a36a1b9866d

SHA512
a8e7a977cb12117cbdb93061eaa26920d9b6fb193c89a93290caa2aa84953520237e6914ce85033537621bc9992de112dd825cb26e4013a3b650b5d6eff1e9cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
106a3833f8ed1178aff22743b0a21428

SHA1
93536f53cbd11ed7eeac864164e626aaf8f203fd

SHA256
3a460220ece0fa655083a52386eb115e435f3b09c220c2bd4fe7028223e45c9b

SHA512
2672079e36e49903ff58cc7a81e2e97b98ac57744455dc86b4e9e6a7457c66f5369ae56e9501115c4bb0080a522e0f2ccc3632d281dae490bc1fadf8f3c7caa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581393.TMP

Filesize
48B

MD5
6cebe5741c2788b36e4910bb1c85dbff

SHA1
fd97f33faaecd3f832f24c2cc4f5d75ae0f74efd

SHA256
3455cdd6ea15b514057cdec96055041a966452550a70dfe3aae72a46ec0a80f3

SHA512
7ca4834179c5288c2e09cde95b12a5bc552bc89b3781bb97ef67f69c3e1d84319f9f432cd07b17e3f66f214a55908d6cd7ea2301c439737dae22af645aa0b861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
06c3ede4cc2cbdf4fad55a8aa3e3981d

SHA1
79e75259ec2cefb2ec9b938cbc4a747171220695

SHA256
b6654c25cd5e223a9050211a32bfd791d9b2482d33c48b5d5a0848ef2365ba29

SHA512
ec7a1c09e5262b3487fed8a90972eed97842258b368fce9f145d895da44fbeaaed35394f3d4e03ceda8ee2583f383de3c709d324fcdbc77df73735466f7a9613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff53c819e90fb1b775e476648fca3371

SHA1
ee4327f546bad5e9fc6f8f1e46494a7cf2906388

SHA256
0e8c88192589af1df4268ff4a504f9ce185689173d61ac581053201cfa8d28a9

SHA512
2fbfdefc139354bb70f43c2a610ddf7033df93e5577f08517a793d327061d5e3f5e8e4364311d5c8bb55efa29e06fb5af5cc5ceaa4645999425ddc4be1ae5332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6269f0afa2aed203ff0d3ceb5d274834

SHA1
fa538265712f2e492ec91ba954520c798d8d050c

SHA256
6ffc2715d2532b0f994426b8bbd420322a56d8f7db59fc6acf862a3066869630

SHA512
19f5a2af5175facc70cae265392b9164356c0483cb695074bec7838340a980b5a58d4d4fd877cac56fd130ce93cbb8cc7a0240e4908bf98c69789c08817ca735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0ef2dbfadd5dd72a258c5717f3871bf8

SHA1
799f5bc8b0c6aeaef92e197df07317af37b45202

SHA256
faf4265c514ac43361e836510583175b9dd3a73f5b1294380ae4a9ddde7d2b79

SHA512
70580723851e2dae41a566c5edd7b1ad49c7ca165c9e3c8b4b79766b5778bfe78a6accc19ebfe99bd0ccdb3c9534e3669e5df69ffcad96defbe72750031c7c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e772.TMP

Filesize
539B

MD5
014330885ac0a183f9688511032e3abf

SHA1
ba4e405f749671908a14dbd0be7f805ce30d78d2

SHA256
736fc272da330c3265f106f2b5640cc9432629ff6c0a46103b6a349817a3cad3

SHA512
ce12d3dd4fcec2073ee7632582890985f0f58a0324170dbdfbaa4ca031bf0343f9a953f915dfbc3b38af32b622a50d1a86db73a137f256065d111ea840f0b4ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
975878d3be7144dc58502296414e6cc7

SHA1
3b10d9d1ea38b52112dae9861d1466521f0c5031

SHA256
b3975209bf6f7e0c2b6a4ea039125c4d1a264dc9cde0a37de3c6c0cb9e271e43

SHA512
8b0a05b15bb67a1f2fa645aaf09874f66ce8b6192137a169b85f51c02bb5b128e742294b9141a548b56f99b1235e3c247bf39c9cf0fa99aa0050ed0e876637d4

Download Submit
memory/1548-97-0x000001EA42510000-0x000001EA42511000-memory.dmp

Filesize
4KB

Download
memory/1548-77-0x000001EA3A060000-0x000001EA3A070000-memory.dmp

Filesize
64KB

Download
memory/1548-61-0x000001EA39F60000-0x000001EA39F70000-memory.dmp

Filesize
64KB

Download
memory/1548-93-0x000001EA423D0000-0x000001EA423D1000-memory.dmp

Filesize
4KB

Download
memory/1548-95-0x000001EA42400000-0x000001EA42401000-memory.dmp

Filesize
4KB

Download
memory/1548-96-0x000001EA42400000-0x000001EA42401000-memory.dmp

Filesize
4KB

Download