arkei | 4b8067eeb1ff123514e59e09404686f72e9587b723814dd19efdecef767e848a

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a9f6c4b7a5c0716912b22366f2b84ae.exe
Size

317KB
MD5

4a9f6c4b7a5c0716912b22366f2b84ae
SHA1

c89d3f01152d9c593583545403492d958210831e
SHA256

4b8067eeb1ff123514e59e09404686f72e9587b723814dd19efdecef767e848a
SHA512

3d318bec41b833930577857e3d7ae3725c3560f4bb9692bb8a448ab1324f7f0ccc28d1ccbe7b9af7149caffc14efcac63d3a43893b6210e8f878e903a16d6085

Score

10^/10

arkei default discovery persistence spyware stealer

Malware Config

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3940	u3ec.0.exe
332	u3ec.0.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	4a9f6c4b7a5c0716912b22366f2b84ae.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	u3ec.0.exe

Loads dropped DLL 2 IoCs

pid	Process
332	u3ec.0.exe
332	u3ec.0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3940 set thread context of 332	3940	u3ec.0.exe	100

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f15dd0d7-ac33-44aa-828f-bb303127be25.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220731134637.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u3ec.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u3ec.0.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4948	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
1432	msedge.exe
1432	msedge.exe
640	identity_helper.exe
640	identity_helper.exe
5152	msedge.exe
5152	msedge.exe
5152	msedge.exe
5152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3940	4404	4a9f6c4b7a5c0716912b22366f2b84ae.exe	83
PID 4404 wrote to memory of 3940	4404	4a9f6c4b7a5c0716912b22366f2b84ae.exe	83
PID 4404 wrote to memory of 3940	4404	4a9f6c4b7a5c0716912b22366f2b84ae.exe	83
PID 4404 wrote to memory of 1432	4404	4a9f6c4b7a5c0716912b22366f2b84ae.exe	85
PID 4404 wrote to memory of 1432	4404	4a9f6c4b7a5c0716912b22366f2b84ae.exe	85
PID 1432 wrote to memory of 4640	1432	msedge.exe	86
PID 1432 wrote to memory of 4640	1432	msedge.exe	86
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 2280	1432	msedge.exe	89
PID 1432 wrote to memory of 5084	1432	msedge.exe	90
PID 1432 wrote to memory of 5084	1432	msedge.exe	90
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91
PID 1432 wrote to memory of 2780	1432	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\4a9f6c4b7a5c0716912b22366f2b84ae.exe
"C:\Users\Admin\AppData\Local\Temp\4a9f6c4b7a5c0716912b22366f2b84ae.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\u3ec.0.exe
  "C:\Users\Admin\AppData\Local\Temp\u3ec.0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3940
- - C:\Users\Admin\AppData\Local\Temp\u3ec.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u3ec.0.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    PID:332
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\u3ec.0.exe" & exit
      4⤵
      PID:4424
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yip.su/2N19t7
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf95746f8,0x7ffdf9574708,0x7ffdf9574718
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6fd955460,0x7ff6fd955470,0x7ff6fd955480
      4⤵
      PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3400 /prefetch:8
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3488 /prefetch:8
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4696 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2012,3660901952977559962,6295767932607979518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1880 /prefetch:8
    3⤵
    PID:5208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\nss3.dll

Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
acdea8b59e563ac19cffeaaca781bf14

SHA1
06fbe02adfa3be384016ac8c8bb0eb9c709a7a1d

SHA256
44e20ead00be34f17e2be7ef7941d68934e29aa3f24ce88d9c763ec4740bd7ca

SHA512
edd9b6a49594c683ce7d6065177fe720021e6ef46f2f9c7f684d29daf77ca9649d5c378a6fadbded0150312a19c6e374798d56f6871ea62df9313a2293514d2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb55172a8bd4c93b2780e837cce054f4

SHA1
7e890e6af6b7734f05f44119862f035304c3686e

SHA256
18a2b864eeb4243bdc0a7d0083e10773986619d51d2a6336c6da8af3b14ffe75

SHA512
e9cc7c1bcf98c716d70b787abab5f00782136011b3e3ae70c85ca2a45a5432b21c4327ec13bd3faccb3150fd978b714e6a635aebd0ee4d61b5d11745f0b350b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3ec.0.exe

Filesize
364KB

MD5
a5a77a06940cb5c8933934b8c9e4ac27

SHA1
a4d0bebefcbef7b718acd9f2e69a9b7767213a51

SHA256
7626e47624b6d66f33395c1c0febb9d8f2c8eb9197ad4eda6c61f86f8660b7b8

SHA512
dcaaabc990fd6f971810887a27cd7204bf5cc3cd16e7f4ac0712e41a277051980a079f4b9ea181d1d4509aa56b6b74d454ad2877b50e67029080adb79e7a5aad

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3ec.0.exe

Filesize
364KB

MD5
a5a77a06940cb5c8933934b8c9e4ac27

SHA1
a4d0bebefcbef7b718acd9f2e69a9b7767213a51

SHA256
7626e47624b6d66f33395c1c0febb9d8f2c8eb9197ad4eda6c61f86f8660b7b8

SHA512
dcaaabc990fd6f971810887a27cd7204bf5cc3cd16e7f4ac0712e41a277051980a079f4b9ea181d1d4509aa56b6b74d454ad2877b50e67029080adb79e7a5aad

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3ec.0.exe

Filesize
364KB

MD5
a5a77a06940cb5c8933934b8c9e4ac27

SHA1
a4d0bebefcbef7b718acd9f2e69a9b7767213a51

SHA256
7626e47624b6d66f33395c1c0febb9d8f2c8eb9197ad4eda6c61f86f8660b7b8

SHA512
dcaaabc990fd6f971810887a27cd7204bf5cc3cd16e7f4ac0712e41a277051980a079f4b9ea181d1d4509aa56b6b74d454ad2877b50e67029080adb79e7a5aad

Download Submit
memory/332-153-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/332-192-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/332-150-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/332-156-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/332-166-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/3940-155-0x00000000006C0000-0x00000000006EA000-memory.dmp

Filesize
168KB

Download
memory/3940-154-0x000000000071C000-0x000000000073D000-memory.dmp

Filesize
132KB

Download