Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-04-2024 00:46
Static task
static1
Behavioral task
behavioral1
Sample
REXObfuscator.exe
Resource
win10v2004-20240419-en
General
-
Target
REXObfuscator.exe
-
Size
4.9MB
-
MD5
c80af0de7960d66227c20901ad220feb
-
SHA1
83fe8468210035bbb2c24b50645a11e62fb377bd
-
SHA256
a0dee72c5357c474929e083d2205d18b00fedb479ba4fba32fffc91c3d32c6b9
-
SHA512
f34e1a276cd3db5676e5d6ef92343f1d456c72e93024cf9bde817bf6a3ae0aa9f903123b3796862fa28e1e8cbcf1271bb77f96ac4f699a79ddab1134fb924f13
-
SSDEEP
98304:Fz/2M3gz6lUcoD83VAZGtqEnQcvytg1ucK3t:V/2M3/lfXlAZXEnQcaeucK3t
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2416-8-0x0000000005DC0000-0x0000000005FD2000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
REXObfuscator.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions REXObfuscator.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
REXObfuscator.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools REXObfuscator.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
REXObfuscator.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion REXObfuscator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion REXObfuscator.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
REXObfuscator.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum REXObfuscator.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 REXObfuscator.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
REXObfuscator.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS REXObfuscator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer REXObfuscator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion REXObfuscator.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3062789476-783164490-2318012559-1000\{940D45DC-CB1D-450E-A8E6-82A35C467B6F} msedge.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
REXObfuscator.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 2416 REXObfuscator.exe 3568 msedge.exe 3568 msedge.exe 3112 msedge.exe 3112 msedge.exe 2416 REXObfuscator.exe 3852 msedge.exe 3852 msedge.exe 2416 REXObfuscator.exe 3816 identity_helper.exe 3816 identity_helper.exe 2432 msedge.exe 2432 msedge.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 2416 REXObfuscator.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
REXObfuscator.exedescription pid process Token: SeDebugPrivilege 2416 REXObfuscator.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
REXObfuscator.exemsedge.exedescription pid process target process PID 2416 wrote to memory of 3112 2416 REXObfuscator.exe msedge.exe PID 2416 wrote to memory of 3112 2416 REXObfuscator.exe msedge.exe PID 3112 wrote to memory of 1600 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 1600 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4808 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 3568 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 3568 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4804 3112 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REXObfuscator.exe"C:\Users\Admin\AppData\Local\Temp\REXObfuscator.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/unban2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffad2683cb8,0x7ffad2683cc8,0x7ffad2683cd83⤵PID:1600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:23⤵PID:4808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3568 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:83⤵PID:4804
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:13⤵PID:3584
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:13⤵PID:348
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:13⤵PID:4728
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4036 /prefetch:83⤵PID:5092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3256 /prefetch:83⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3852 -
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3816 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3984 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:13⤵PID:3732
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:13⤵PID:4176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:13⤵PID:1708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:13⤵PID:4908
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,14649755992391656803,14508103811672265699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5716 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:348
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:396
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5704d4cabea796e63d81497ab24b05379
SHA1b4d01216a6985559bd4b6d193ed1ec0f93b15ff8
SHA2563db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26
SHA5120f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5de47c3995ae35661b0c60c1f1d30f0ab
SHA16634569b803dc681dc068de3a3794053fa68c0ca
SHA2564d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7
SHA512852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
840B
MD543068d26459360723351e2bd302595d4
SHA14fe707e6e266c30f4fb3f414a61cc58193931a52
SHA25665490f1951a0acc69fb6b9ee52cd8e9d5972f408120670167fe27f2a06df5f64
SHA512710d89555f7742710fa2be63f0f6b2063d4a462987fbdad7ccf1c3de0048c7e2e2350cde4d9d287988c30fe5139ef1bd7f0bba8b3acf84c7c69335218b0568a3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
323B
MD574c9e7193b0cb61e692095d8d9e01ae8
SHA12f60d0b754e400d545d5f3829ae3b0a0b990d821
SHA256b51c6699b167d0179b11f965336dd9133829945e8992fb391043536d336d9baf
SHA512e3abb8a66b88de18aa084934f2d481d7f10060d35b0426a12b7dc1e7a3a8199261be181e889a4054c5d108884a16eb304a7e1b575de21820bd97acb48c13d747
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD545fbe084ca6bf0581469a034f382786b
SHA197fe11863aab981e9fb253b81adef2b4625971ae
SHA256fdf9f30ff5fba392aa7a04253da76417c00665f7639b670953f1e1726732483a
SHA5125aa3e4fd57b94180d6e29cec704870274578c58510532fc7bbbd519704036fe05841b10c5c333eb3d2df71b514fa25c1cffbd243a9a98f705a3a891753d87f1d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53ffeb8fd4bdfbabec5b9b1496160dadc
SHA1406e463c76e9b4283cbb964608b33976bc723c7b
SHA256ab650795f465291660b96dee5fbb44d37eae42b39bd3530c44a2883851a12ac1
SHA5121c1348cbc2c5991be18ed8e64ab601c2b6f31928a3373b4736de95c1fd6ce1537c97761ddc5a1b9134f48040c5e06e0009b48b82147e06007841a5ee01ae77ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5b72d31f94f3ab863159eb83e0b1e5787
SHA19d795b582493cf8d18dff96ce8caca3c89d73ede
SHA2560148951ca66125f59e715fd39de87cda1dabeb818c73242b07632efbd2033e66
SHA5125d658b825d2764acb688e8d1a711065f2c5b9c1206e5270d44c55a4435dfb606a7bc79708098fd3986f276de5c5f7fed2a2165e3973fdacda44bc2f3e3d2887b
-
\??\pipe\LOCAL\crashpad_3112_HOPGOQWSAYZCBJEWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2416-6-0x0000000007230000-0x0000000007296000-memory.dmpFilesize
408KB
-
memory/2416-5-0x0000000007090000-0x0000000007122000-memory.dmpFilesize
584KB
-
memory/2416-13-0x000000000A340000-0x000000000A37C000-memory.dmpFilesize
240KB
-
memory/2416-10-0x0000000009A40000-0x0000000009A52000-memory.dmpFilesize
72KB
-
memory/2416-9-0x00000000059B0000-0x00000000059C0000-memory.dmpFilesize
64KB
-
memory/2416-8-0x0000000005DC0000-0x0000000005FD2000-memory.dmpFilesize
2.1MB
-
memory/2416-7-0x0000000005D30000-0x0000000005D3A000-memory.dmpFilesize
40KB
-
memory/2416-0-0x0000000000A10000-0x0000000000F0E000-memory.dmpFilesize
5.0MB
-
memory/2416-4-0x0000000007640000-0x0000000007BE6000-memory.dmpFilesize
5.6MB
-
memory/2416-11-0x0000000009AC0000-0x0000000009B72000-memory.dmpFilesize
712KB
-
memory/2416-3-0x0000000006CD0000-0x0000000007092000-memory.dmpFilesize
3.8MB
-
memory/2416-164-0x0000000074FC0000-0x0000000075771000-memory.dmpFilesize
7.7MB
-
memory/2416-165-0x00000000059B0000-0x00000000059C0000-memory.dmpFilesize
64KB
-
memory/2416-166-0x00000000059B0000-0x00000000059C0000-memory.dmpFilesize
64KB
-
memory/2416-2-0x00000000059B0000-0x00000000059C0000-memory.dmpFilesize
64KB
-
memory/2416-191-0x0000000074FC0000-0x0000000075771000-memory.dmpFilesize
7.7MB
-
memory/2416-1-0x0000000074FC0000-0x0000000075771000-memory.dmpFilesize
7.7MB