| File name: | b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad |
| Full analysis: | https://app.any.run/tasks/3ca7d8f5-3b7f-449d-ae41-c85e2064d644 |
| Verdict: | Malicious activity |
| Threats: | Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files. |
| Analysis date: | April 11, 2022, 01:51:33 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | BB41FBDDC48FC3548D55A6AD9C321832 |
| SHA1: | 1E1AF9C4475419B5C73E57A8A9938EF840E2652C |
| SHA256: | B92F4B4684951FF2E5ABDB1280E6BFF80A14B83F25E4F3DE39985F188D0F3AAD |
| SSDEEP: | 6144:t7PPxkwiM8n2baBUTz8nwa9C3cNBePoITNhb6ppZGWg/ERY32:1kM822UTgnMcNWzveppZGWg/E |
MALICIOUS
ARKEI detected by memory dumps
- b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe (PID: 3796)
SUSPICIOUS
Checks supported languages
- b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe (PID: 2800)
- b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe (PID: 3796)
Reads the computer name
- b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe (PID: 3796)
Application launched itself
- b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe (PID: 2800)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Arkei
(PID) Process(3796) b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe
C2https://computerprotect.me
Mutex04123309318226059368
other (621)LoadLibraryA
GetProcAddress
ExitProcess
advapi32.dll
crypt32.dll
GetTickCount
Sleep
GetUserDefaultLangID
CreateMutexA
GetLastError
HeapAlloc
GetProcessHeap
GetComputerNameA
VirtualProtect
GetCurrentProcess
VirtualAllocExNuma
GetUserNameA
CryptStringToBinaryA
HAL9TH
JohnDoe
01/04/2022 20:00:00
https://
computerprotect.me
04123309318226059368
/vpnchecker.php
Default
%hu/%hu/%hu %hu:%hu:%hu
open
sqlite3.dll
C:\ProgramData\sqlite3.dll
freebl3.dll
C:\ProgramData\freebl3.dll
mozglue.dll
C:\ProgramData\mozglue.dll
msvcp140.dll
C:\ProgramData\msvcp140.dll
nss3.dll
C:\ProgramData\nss3.dll
softokn3.dll
C:\ProgramData\softokn3.dll
vcruntime140.dll
C:\ProgramData\vcruntime140.dll
.zip
Tag:
IP: IP?
Country: Country?
Working Path:
Local Time:
TimeZone:
Display Language:
Keyboard Languages:
Is Laptop:
Processor:
Installed RAM:
OS:
(
Bit)
Videocard:
Display Resolution:
PC name:
User name:
Domain name:
MachineID:
GUID:
Installed Software:
system.txt
Grabber\%s.zip
%APPDATA%
%LOCALAPPDATA%
%USERPROFILE%
%DESKTOP%
Wallets\
Ethereum
\Ethereum\
keystore
Electrum
\Electrum\wallets\
*.*
ElectrumLTC
\Electrum-LTC\wallets\
Exodus
\Exodus\
exodus.conf.json
window-state.json
\Exodus\exodus.wallet\
passphrase.json
seed.seco
info.seco
ElectronCash
\ElectronCash\wallets\
default_wallet
MultiDoge
\MultiDoge\
multidoge.wallet
JAXX
\jaxx\Local Storage\
file__0.localstorage
Atomic
\atomic\Local Storage\leveldb\
000003.log
CURRENT
LOCK
LOG
MANIFEST-000001
0000*
Binance
\Binance\
app-store.json
Coinomi
\Coinomi\Coinomi\wallets\
*.wallet
*.config
*wallet*.dat
GetSystemTime
lstrcatA
SystemTimeToFileTime
ntdll.dll
sscanf
memset
memcpy
wininet.dll
user32.dll
gdi32.dll
netapi32.dll
psapi.dll
bcrypt.dll
vaultcli.dll
shlwapi.dll
shell32.dll
gdiplus.dll
ole32.dll
dbghelp.dll
CreateFileA
WriteFile
CloseHandle
GetFileSize
lstrlenA
LocalAlloc
GlobalFree
ReadFile
OpenProcess
SetFilePointer
SetEndOfFile
GetCurrentProcessId
GetLocalTime
GetTimeZoneInformation
GetUserDefaultLocaleName
LocalFree
GetSystemPowerStatus
GetSystemInfo
GlobalMemoryStatusEx
IsWow64Process
GetTempPathA
GetLocaleInfoA
GetFileSizeEx
GetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
GetCurrentDirectoryA
CopyFileA
DeleteFileA
lstrcmpW
GlobalAlloc
FreeLibrary
SetCurrentDirectoryA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FileTimeToSystemTime
GetFileInformationByHandle
GlobalLock
GlobalSize
WideCharToMultiByte
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetModuleFileNameA
CreateFileW
CreateFileMappingW
MultiByteToWideChar
CreateThread
GetEnvironmentVariableA
SetEnvironmentVariableA
lstrcpyA
lstrcpynA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile
InternetSetOptionA
InternetOpenUrlA
InternetCrackUrlA
wsprintfA
CharToOemW
GetKeyboardLayoutList
EnumDisplayDevicesA
ReleaseDC
GetDC
GetSystemMetrics
GetDesktopWindow
GetWindowRect
GetWindowDC
CloseWindow
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetCurrentHwProfileA
RegEnumKeyExA
RegGetValueA
CreateDCA
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
StretchBlt
GetObjectW
GetDIBits
SaveDC
CreateDIBSection
DeleteDC
RestoreDC
DsRoleGetPrimaryDomainInformation
GetModuleFileNameExA
CryptUnprotectData
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDecrypt
VaultOpenVault
VaultCloseVault
VaultEnumerateItems
VaultGetItemWin8
VaultGetItemWin7
VaultFree
StrCmpCA
StrStrA
PathMatchSpecA
SHGetFolderPathA
ShellExecuteExA
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipDisposeImage
GdipFree
CreateStreamOnHGlobal
GetHGlobalFromStream
SymMatchString
HEAD
HTTP/1.1
GET
POST
file
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="
Content-Disposition: form-data; name="file"; filename="
Content-Type: application/octet-stream
Content-Transfer-Encoding: binary
SOFT:
PROF: ?
PROF:
HOST:
USER:
PASS:
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
"}
PATH
PATH=
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
SELECT origin_url, username_value, password_value FROM logins
Cookies\%s_%s.txt
SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
TRUE
FALSE
Autofill\%s_%s.txt
SELECT name, value FROM autofill
CC\%s_%s.txt
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Card number:
Name on card:
Expiration date:
History\%s_%s.txt
SELECT url FROM urls
Downloads\%s_%s.txt
SELECT target_path, tab_url from downloads
Login Data
Cookies
Web Data
History
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
logins.json
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places
cookies.sqlite
formhistory.sqlite
places.sqlite
\Local State
..\profiles.ini
C:\ProgramData\
Chrome
\Google\Chrome\User Data
ChromeBeta
\Google\Chrome Beta\User Data
ChromeCanary
\Google\Chrome SxS\User Data
Chromium
\Chromium\User Data
Edge_Chromium
\Microsoft\Edge\User Data
Kometa
\Kometa\User Data
Amigo
\Amigo\User Data
Torch
\Torch\User Data
Orbitum
\Orbitum\User Data
Comodo
\Comodo\Dragon\User Data
Nichrome
\Nichrome\User Data
Maxthon5
\Maxthon5\Users
Sputnik
\Sputnik\User Data
EPB
\Epic Privacy Browser\User Data
Vivaldi
\Vivaldi\User Data
CocCoc
\CocCoc\Browser\User Data
Uran
\uCozMedia\Uran\User Data
QIP
\QIP Surf\User Data
Cent
\CentBrowser\User Data
Elements
\Elements Browser\User Data
TorBro
\TorBro\Profile
CryptoTab
\CryptoTab Browser\User Data
Brave
\BraveSoftware\Brave-Browser\User Data
Opera
\Opera Software\Opera Stable\
OperaGX
\Opera Software\Opera GX Stable\
OperaNeon
\Opera Software\Opera Neon\User Data
Firefox
\Mozilla\Firefox\Profiles\
SlimBrowser
\FlashPeak\SlimBrowser\Profiles\
PaleMoon
\Moonchild Productions\Pale Moon\Profiles\
Waterfox
\Waterfox\Profiles\
Cyberfox
\8pecxstudios\Cyberfox\Profiles\
BlackHawk
\NETGATE Technologies\BlackHawk\Profiles\
IceCat
\Mozilla\icecat\Profiles\
KMeleon
\K-Meleon\
Thunderbird
\Thunderbird\Profiles\
passwords.txt
ibnejdfjmmkpcnlpebklmnkoeoihofec
TronLink
nkbihfbeogaeaoehlefnkodbefgpgknn
MetaMask
fhbohimaelbohpjbbldcngcnapndodjp
Binance Chain Wallet
ffnbelfdoeiohenkjibnmadjiehjhajb
Yoroi
jbdaocneiiinmjbjlgalhcelgbejmnid
Nifty Wallet
afbcbjpbpfadlkmhmclhkeeodmamcflc
Math Wallet
hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase Wallet
hpglfhgfnhbgpjdenjgmdgoeiappafln
Guarda
blnieiiffboillknjnepogjhkgnoapac
EQUAL Wallet
cjelfplplebdjjenllpjcblmjkfcffne
Jaxx Liberty
fihkakfobkmkjojpchpfgcmhfjnmnfpi
BitApp Wallet
kncchdigobghenbbaddojjnnaogfppfj
iWallet
amkmjjmmflddogmhpjloimipbofnfjih
Wombat
nlbmnnijcnlegkjjpcfjclmcfggfefdm
MEW CX
nanjmdknhkinifnkgdcggcfnhdaammmj
GuildWallet
nkddgncdjgjfcddamfgcmfnlhccnimig
Saturn Wallet
fnjhmkhhmkbjkkabndcnnogagogbneec
Ronin Wallet
cphhlgmgameodnhkjdmkpanlelnlohao
NeoLine
nhnkbkgjikgcigadomkphalanndcapjk
Clover Wallet
kpfopkelmapcoipemfendmdcghnegimn
Liquality Wallet
aiifbnbfobpmeekipheeijimdpnlpgpp
Terra Station
dmkamcknogkgcdfhhbddcghachkejeap
Keplr
fhmfendgdocmcbmfikdcogofphimnkno
Sollet
cnmamaachppnkjgnildpdmkaakejnhae
Auro Wallet
jojhfeoedkpkglbfimdfabpdfjaoolaf
Polymesh Wallet
flpiciilemghbmfalicajoolhkkenfel
ICONex
nknhiehlklippafakaeklbeglecifhad
Nabox Wallet
hcflpincpppdclinealmandijcmnkbgn
KHC
ookjlbkiijinhpmnjffcofjonbfbgaoc
Temple
mnfifefkajgofkcjkemidiaecocnkjeh
TezBox
dkdedlpgdmmkkfjabffeganieamfklkm
Cyano Wallet
nlgbhdfgdhgbiamfdfmbikcdghidoadd
Byone
infeboajgfhgbjpjbeppbkgnabfdkdaf
OneKey
cihmoadaighcejopammfbmddcmdekcje
LeafWallet
lodccjjbdhfakaekdiahmedfbieldgik
DAppPlay
ijmpgkjfkbfhoebgogflfebnmejmfbml
BitClip
lkcjlnjfpbikmcmbachjpdbijejflpcm
Steem Keychain
onofpnbbkehpmmoabgpcpmigafmmnjhl
Nash Extension
bcopgchhojmggmffilplmbdicgaihlkp
Hycon Lite Client
klnaejjgbibmhlephnhpmaofohgkpgkd
ZilPay
aeachknmefphepccionboohckonoeemg
Coin98 Wallet
bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom
hifafgmccdpekplomjjkcfgodnhcellj
Crypto.com
dngmlblcodfobpdpecaadgfbcggfjfnm
Maiar DeFi Wallet
ppdadbejkmjnefldpcdjhnkpbjkikoip
Oasis
hpbgcgmiemanfelegbndmhieiigkackl
MonstaWallet
fcckkdbjnoikooededlapcalpionmalo
MOBOX
jccapkebeeiajkkdemacblkjhhhboiek
Crust Wallet
mgffkfbidihjpoaomajlbgchddlicgpn
Pali Wallet
nphplpgoakhhjchkkhmiggakijnkhfnd
TON Wallet
ldinpeekobnhjjdofggfgjlcehhmanlj
Hiro Wallet
pocmplpaccanhmnllbbkpgfliimjljgo
Slope Wallet
bhhhlbepdkbapadjdnnojkbgioiodbic
Solflare Wallet
pgiaagfkgcbnmiiolekcfmljdagdhlcm
Stargazer Wallet
cgeeodpfagjceefieflmdfphplkenlfk
EVER Wallet
gjkdbeaiifkpoencioahhcilildpjhgh
partisia-wallet
bgjogpoidejdemgoochpnkmdjpocgkha
Ecto Wallet
ifckdpamphokdglkkdomedpdegcjhjdp
ONTO Wallet
agechnindjilpccclelhlbjphbgnobpf
Fractal Wallet
algblmhagnobbnmakepomicmfljlbehg
ADS Wallet
imijjbmbnebfnbmonjeileijahaipglj
Moonlet Wallet
kpjdchaapjheajadlaakiiigcbhoppda
ZEBEDEE
dlcobpjiigpikoobohmabehhmhfoodbb
Argent X StarkNet Wallet
bofddndhbegljegmpmnlbhcejofmjgbn
X-Wallet
mapbhaebnddapnmifbbkgeedkeplgjmf
Biport Wallet
kfdniefadaanbjodldohaedphafoffoh
Typhon Wallet
jaooiolkmfcmloonphpiiogkfckgciom
Twetch Wallet
aijcbedoijmgnlmjeegjaglmepbmpkpi
Leap Wallet
fhfffofbcgbjjojdnpcfompojdjjhdim
Lamden Wallet
agkfnefiabmfpanochlcakggnkdfmmjd
Earth Wallet
lpfcbjknijpeeillifnkikgncikgfhdo
Nami
fecfflganphcinpahcklgahckeohalog
Coin Wallet
ilhaljfiglknggcoegeknjghdgampffk
Beam Web Wallet
dklmlehijiaepdijfnbbhncfpcoeeljf
FShares Wallet
fkhebcilafocjhnlcngogekljmllgdhd
WAGMIswap.io Wallet
laphpbhjhhgigmjoflgcchgodbbclahk
BLUE - Worlds Safest and Simplest Wallet
mkjjflkhdddfjhonakofipfojoepfndk
Unification Web Wallet
jnldfbidonfeldmalbflbmlebbipcnle
Infinity Wallet
ellkdbaphhldpeajbepobaecooaoafpg
Fetch.ai Network Wallet
iokeahhehimjnekafflcihljlcjccdbe
Alby Wallet
omajpeaffjgmlpmhbfdjepdejoemifpe
xBull Wallet
pgojdfajgcjjpjnbpfaelnpnjocakldb
Sugarchain Wallet
pnndplcbkakcplkjnolgbkdgjikjednm
Tronium
fnnegphlobjdpkhecapkijjdkgcjhkib
Harmony
fhilaheimglignddkjgofkcbgekhenbh
Oxygen
cmbagcoinhmacpcgmbiniijboejgiahi
JustLiquidity Wallet
kmmolakhbgdlpkjkcjkebenjheonagdm
AlgoSigner
fnabdmcgpkkjjegokfcnfbpneacddpfh
Goldmint Lite Wallet
bgpipimickeadkjlklgciifhnalhdjhe
GeroWallet
hoighigmnhgkkdaenafgnefkcmipfjon
EO.Finance
nlgnepoeokdfodgjkjiblkadkjbdfmgd
Multi Wallet
nhihjlnjgibefgjhobhcphmnckoogdea
Waves Enterprise Wallet
ehibhohmlpipbaogcknmpmiibbllplph
Bluehelix Wallet
magbanejlegnbcppjljfhnmfmghialkl
Nebulas Wallet
fgkaeeikaoeiiggggbgdcjchmdfmamla
Vtimes
pnlfjmlcjdjgkddecgincndfgegkecke
Crocobit Wallet
bhghoamapcdpbohphigoooaddinpkbai
Authenticator
gaedmjdfmmahhbjefcbgaolhhanlaolb
Authy
oeljdldpnmdbchonielidgobddffflal
EOS Authenticator
ilgcnhelpchnceeipipijaljkblbcobl
GAuth Authenticator
imloifkgjagghnncjkhggdhalmcnfklk
Trezor Password Manager
%s\%s\Local Extension Settings\%s
%s\CURRENT
%s\%s\Sync Extension Settings\%s
%s\%s\IndexedDB\chrome-extension_%s_0.indexeddb.leveldb
Plugins\
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
x64
x86
DISPLAY
SOFTWARE\Microsoft\Cryptography
MachineGuid
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayName
DisplayVersion
screenshot.jpg
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
/c timeout /t 5 & del /f /q "%s" & exit
C:\Windows\System32\cmd.exe
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (35.8) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (31.7) |
| .scr | | | Windows screen saver (15) |
| .dll | | | Win32 Dynamic Link Library (generic) (7.5) |
| .exe | | | Win32 Executable (generic) (5.1) |
EXIF
EXE
| FileSubtype: | - |
|---|---|
| ObjectFileType: | Executable application |
| FileOS: | Windows NT 32-bit |
| FileFlags: | Special build |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 18.0.0.0 |
| FileVersionNumber: | 20.0.0.0 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 5 |
| ImageVersion: | - |
| OSVersion: | 5 |
| EntryPoint: | 0xb870 |
| UninitializedDataSize: | - |
| InitializedDataSize: | 807936 |
| CodeSize: | 185856 |
| LinkerVersion: | 9 |
| PEType: | PE32 |
| TimeStamp: | 2020:11:12 05:39:11+01:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 12-Nov-2020 04:39:11 |
| Debug artifacts: |
|
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000E0 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 4 |
| Time date stamp: | 12-Nov-2020 04:39:11 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0002D55A | 0x0002D600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.28196 |
.data | 0x0002F000 | 0x000BB268 | 0x00019200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.74847 |
.rsrc | 0x000EB000 | 0x00005D48 | 0x00005E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.23094 |
.reloc | 0x000F1000 | 0x00004184 | 0x00004200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 3.84957 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.70641 | 1736 | UNKNOWN | UNKNOWN | RT_ICON |
2 | 5.89572 | 1384 | UNKNOWN | UNKNOWN | RT_ICON |
3 | 5.66664 | 4264 | UNKNOWN | UNKNOWN | RT_ICON |
4 | 5.7769 | 2440 | UNKNOWN | UNKNOWN | RT_ICON |
5 | 6.19049 | 1128 | UNKNOWN | UNKNOWN | RT_ICON |
6 | 4.09164 | 304 | UNKNOWN | UNKNOWN | RT_CURSOR |
7 | 2.5416 | 304 | UNKNOWN | UNKNOWN | RT_CURSOR |
8 | 2.50404 | 240 | UNKNOWN | UNKNOWN | RT_CURSOR |
9 | 1.59806 | 4264 | UNKNOWN | UNKNOWN | RT_CURSOR |
10 | 2.97359 | 2216 | UNKNOWN | UNKNOWN | RT_CURSOR |
Imports
GDI32.dll |
KERNEL32.dll |
Total processes
34
Monitored processes
2
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2800 | "C:\Users\admin\AppData\Local\Temp\b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe" | C:\Users\admin\AppData\Local\Temp\b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3796 | "C:\Users\admin\AppData\Local\Temp\b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe" | C:\Users\admin\AppData\Local\Temp\b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe | b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
Arkei(PID) Process(3796) b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad.exe C2https://computerprotect.me Mutex04123309318226059368 other (621)LoadLibraryA GetProcAddress ExitProcess advapi32.dll crypt32.dll GetTickCount Sleep GetUserDefaultLangID CreateMutexA GetLastError HeapAlloc GetProcessHeap GetComputerNameA VirtualProtect GetCurrentProcess VirtualAllocExNuma GetUserNameA CryptStringToBinaryA HAL9TH JohnDoe 01/04/2022 20:00:00 https:// computerprotect.me 04123309318226059368 /vpnchecker.php Default %hu/%hu/%hu %hu:%hu:%hu open sqlite3.dll C:\ProgramData\sqlite3.dll freebl3.dll C:\ProgramData\freebl3.dll mozglue.dll C:\ProgramData\mozglue.dll msvcp140.dll C:\ProgramData\msvcp140.dll nss3.dll C:\ProgramData\nss3.dll softokn3.dll C:\ProgramData\softokn3.dll vcruntime140.dll C:\ProgramData\vcruntime140.dll .zip Tag: IP: IP? Country: Country? Working Path: Local Time: TimeZone: Display Language: Keyboard Languages: Is Laptop: Processor: Installed RAM: OS: ( Bit) Videocard: Display Resolution: PC name: User name: Domain name: MachineID: GUID: Installed Software: system.txt Grabber\%s.zip %APPDATA% %LOCALAPPDATA% %USERPROFILE% %DESKTOP% Wallets\ Ethereum \Ethereum\ keystore Electrum \Electrum\wallets\ *.* ElectrumLTC \Electrum-LTC\wallets\ Exodus \Exodus\ exodus.conf.json window-state.json \Exodus\exodus.wallet\ passphrase.json seed.seco info.seco ElectronCash \ElectronCash\wallets\ default_wallet MultiDoge \MultiDoge\ multidoge.wallet JAXX \jaxx\Local Storage\ file__0.localstorage Atomic \atomic\Local Storage\leveldb\ 000003.log CURRENT LOCK LOG MANIFEST-000001 0000* Binance \Binance\ app-store.json Coinomi \Coinomi\Coinomi\wallets\ *.wallet *.config *wallet*.dat GetSystemTime lstrcatA SystemTimeToFileTime ntdll.dll sscanf memset memcpy wininet.dll user32.dll gdi32.dll netapi32.dll psapi.dll bcrypt.dll vaultcli.dll shlwapi.dll shell32.dll gdiplus.dll ole32.dll dbghelp.dll CreateFileA WriteFile CloseHandle GetFileSize lstrlenA LocalAlloc GlobalFree ReadFile OpenProcess SetFilePointer SetEndOfFile GetCurrentProcessId GetLocalTime GetTimeZoneInformation GetUserDefaultLocaleName LocalFree GetSystemPowerStatus GetSystemInfo GlobalMemoryStatusEx IsWow64Process GetTempPathA GetLocaleInfoA GetFileSizeEx GetFileAttributesA FindFirstFileA FindNextFileA FindClose GetCurrentDirectoryA CopyFileA DeleteFileA lstrcmpW GlobalAlloc FreeLibrary SetCurrentDirectoryA CreateFileMappingA MapViewOfFile UnmapViewOfFile FileTimeToSystemTime GetFileInformationByHandle GlobalLock GlobalSize WideCharToMultiByte GetWindowsDirectoryA GetVolumeInformationA GetVersionExA GetModuleFileNameA CreateFileW CreateFileMappingW MultiByteToWideChar CreateThread GetEnvironmentVariableA SetEnvironmentVariableA lstrcpyA lstrcpynA InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetCloseHandle InternetReadFile InternetSetOptionA InternetOpenUrlA InternetCrackUrlA wsprintfA CharToOemW GetKeyboardLayoutList EnumDisplayDevicesA ReleaseDC GetDC GetSystemMetrics GetDesktopWindow GetWindowRect GetWindowDC CloseWindow RegOpenKeyExA RegQueryValueExA RegCloseKey GetCurrentHwProfileA RegEnumKeyExA RegGetValueA CreateDCA GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteObject StretchBlt GetObjectW GetDIBits SaveDC CreateDIBSection DeleteDC RestoreDC DsRoleGetPrimaryDomainInformation GetModuleFileNameExA CryptUnprotectData BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt VaultOpenVault VaultCloseVault VaultEnumerateItems VaultGetItemWin8 VaultGetItemWin7 VaultFree StrCmpCA StrStrA PathMatchSpecA SHGetFolderPathA ShellExecuteExA GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipSaveImageToStream GdipDisposeImage GdipFree CreateStreamOnHGlobal GetHGlobalFromStream SymMatchString HEAD HTTP/1.1 GET POST file Content-Type: multipart/form-data; boundary=---- Content-Disposition: form-data; name=" Content-Disposition: form-data; name="file"; filename=" Content-Type: application/octet-stream Content-Transfer-Encoding: binary SOFT: PROF: ? PROF: HOST: USER: PASS: sqlite3_open sqlite3_prepare_v2 sqlite3_step sqlite3_column_text sqlite3_finalize sqlite3_close sqlite3_column_bytes sqlite3_column_blob encrypted_key "} PATH PATH= NSS_Init NSS_Shutdown PK11_GetInternalKeySlot PK11_FreeSlot PK11_Authenticate PK11SDR_Decrypt SELECT origin_url, username_value, password_value FROM logins Cookies\%s_%s.txt SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies TRUE FALSE Autofill\%s_%s.txt SELECT name, value FROM autofill CC\%s_%s.txt SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards Card number: Name on card: Expiration date: History\%s_%s.txt SELECT url FROM urls Downloads\%s_%s.txt SELECT target_path, tab_url from downloads Login Data Cookies Web Data History SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies logins.json formSubmitURL usernameField encryptedUsername encryptedPassword guid SELECT fieldname, value FROM moz_formhistory SELECT url FROM moz_places cookies.sqlite formhistory.sqlite places.sqlite \Local State ..\profiles.ini C:\ProgramData\ Chrome \Google\Chrome\User Data ChromeBeta \Google\Chrome Beta\User Data ChromeCanary \Google\Chrome SxS\User Data Chromium \Chromium\User Data Edge_Chromium \Microsoft\Edge\User Data Kometa \Kometa\User Data Amigo \Amigo\User Data Torch \Torch\User Data Orbitum \Orbitum\User Data Comodo \Comodo\Dragon\User Data Nichrome \Nichrome\User Data Maxthon5 \Maxthon5\Users Sputnik \Sputnik\User Data EPB \Epic Privacy Browser\User Data Vivaldi \Vivaldi\User Data CocCoc \CocCoc\Browser\User Data Uran \uCozMedia\Uran\User Data QIP \QIP Surf\User Data Cent \CentBrowser\User Data Elements \Elements Browser\User Data TorBro \TorBro\Profile CryptoTab \CryptoTab Browser\User Data Brave \BraveSoftware\Brave-Browser\User Data Opera \Opera Software\Opera Stable\ OperaGX \Opera Software\Opera GX Stable\ OperaNeon \Opera Software\Opera Neon\User Data Firefox \Mozilla\Firefox\Profiles\ SlimBrowser \FlashPeak\SlimBrowser\Profiles\ PaleMoon \Moonchild Productions\Pale Moon\Profiles\ Waterfox \Waterfox\Profiles\ Cyberfox \8pecxstudios\Cyberfox\Profiles\ BlackHawk \NETGATE Technologies\BlackHawk\Profiles\ IceCat \Mozilla\icecat\Profiles\ KMeleon \K-Meleon\ Thunderbird \Thunderbird\Profiles\ passwords.txt ibnejdfjmmkpcnlpebklmnkoeoihofec TronLink nkbihfbeogaeaoehlefnkodbefgpgknn MetaMask fhbohimaelbohpjbbldcngcnapndodjp Binance Chain Wallet ffnbelfdoeiohenkjibnmadjiehjhajb Yoroi jbdaocneiiinmjbjlgalhcelgbejmnid Nifty Wallet afbcbjpbpfadlkmhmclhkeeodmamcflc Math Wallet hnfanknocfeofbddgcijnmhnfnkdnaad Coinbase Wallet hpglfhgfnhbgpjdenjgmdgoeiappafln Guarda blnieiiffboillknjnepogjhkgnoapac EQUAL Wallet cjelfplplebdjjenllpjcblmjkfcffne Jaxx Liberty fihkakfobkmkjojpchpfgcmhfjnmnfpi BitApp Wallet kncchdigobghenbbaddojjnnaogfppfj iWallet amkmjjmmflddogmhpjloimipbofnfjih Wombat nlbmnnijcnlegkjjpcfjclmcfggfefdm MEW CX nanjmdknhkinifnkgdcggcfnhdaammmj GuildWallet nkddgncdjgjfcddamfgcmfnlhccnimig Saturn Wallet fnjhmkhhmkbjkkabndcnnogagogbneec Ronin Wallet cphhlgmgameodnhkjdmkpanlelnlohao NeoLine nhnkbkgjikgcigadomkphalanndcapjk Clover Wallet kpfopkelmapcoipemfendmdcghnegimn Liquality Wallet aiifbnbfobpmeekipheeijimdpnlpgpp Terra Station dmkamcknogkgcdfhhbddcghachkejeap Keplr fhmfendgdocmcbmfikdcogofphimnkno Sollet cnmamaachppnkjgnildpdmkaakejnhae Auro Wallet jojhfeoedkpkglbfimdfabpdfjaoolaf Polymesh Wallet flpiciilemghbmfalicajoolhkkenfel ICONex nknhiehlklippafakaeklbeglecifhad Nabox Wallet hcflpincpppdclinealmandijcmnkbgn KHC ookjlbkiijinhpmnjffcofjonbfbgaoc Temple mnfifefkajgofkcjkemidiaecocnkjeh TezBox dkdedlpgdmmkkfjabffeganieamfklkm Cyano Wallet nlgbhdfgdhgbiamfdfmbikcdghidoadd Byone infeboajgfhgbjpjbeppbkgnabfdkdaf OneKey cihmoadaighcejopammfbmddcmdekcje LeafWallet lodccjjbdhfakaekdiahmedfbieldgik DAppPlay ijmpgkjfkbfhoebgogflfebnmejmfbml BitClip lkcjlnjfpbikmcmbachjpdbijejflpcm Steem Keychain onofpnbbkehpmmoabgpcpmigafmmnjhl Nash Extension bcopgchhojmggmffilplmbdicgaihlkp Hycon Lite Client klnaejjgbibmhlephnhpmaofohgkpgkd ZilPay aeachknmefphepccionboohckonoeemg Coin98 Wallet bfnaelmomeimhlpmgjnjophhpkkoljpa Phantom hifafgmccdpekplomjjkcfgodnhcellj Crypto.com dngmlblcodfobpdpecaadgfbcggfjfnm Maiar DeFi Wallet ppdadbejkmjnefldpcdjhnkpbjkikoip Oasis hpbgcgmiemanfelegbndmhieiigkackl MonstaWallet fcckkdbjnoikooededlapcalpionmalo MOBOX jccapkebeeiajkkdemacblkjhhhboiek Crust Wallet mgffkfbidihjpoaomajlbgchddlicgpn Pali Wallet nphplpgoakhhjchkkhmiggakijnkhfnd TON Wallet ldinpeekobnhjjdofggfgjlcehhmanlj Hiro Wallet pocmplpaccanhmnllbbkpgfliimjljgo Slope Wallet bhhhlbepdkbapadjdnnojkbgioiodbic Solflare Wallet pgiaagfkgcbnmiiolekcfmljdagdhlcm Stargazer Wallet cgeeodpfagjceefieflmdfphplkenlfk EVER Wallet gjkdbeaiifkpoencioahhcilildpjhgh partisia-wallet bgjogpoidejdemgoochpnkmdjpocgkha Ecto Wallet ifckdpamphokdglkkdomedpdegcjhjdp ONTO Wallet agechnindjilpccclelhlbjphbgnobpf Fractal Wallet algblmhagnobbnmakepomicmfljlbehg ADS Wallet imijjbmbnebfnbmonjeileijahaipglj Moonlet Wallet kpjdchaapjheajadlaakiiigcbhoppda ZEBEDEE dlcobpjiigpikoobohmabehhmhfoodbb Argent X StarkNet Wallet bofddndhbegljegmpmnlbhcejofmjgbn X-Wallet mapbhaebnddapnmifbbkgeedkeplgjmf Biport Wallet kfdniefadaanbjodldohaedphafoffoh Typhon Wallet jaooiolkmfcmloonphpiiogkfckgciom Twetch Wallet aijcbedoijmgnlmjeegjaglmepbmpkpi Leap Wallet fhfffofbcgbjjojdnpcfompojdjjhdim Lamden Wallet agkfnefiabmfpanochlcakggnkdfmmjd Earth Wallet lpfcbjknijpeeillifnkikgncikgfhdo Nami fecfflganphcinpahcklgahckeohalog Coin Wallet ilhaljfiglknggcoegeknjghdgampffk Beam Web Wallet dklmlehijiaepdijfnbbhncfpcoeeljf FShares Wallet fkhebcilafocjhnlcngogekljmllgdhd WAGMIswap.io Wallet laphpbhjhhgigmjoflgcchgodbbclahk BLUE - Worlds Safest and Simplest Wallet mkjjflkhdddfjhonakofipfojoepfndk Unification Web Wallet jnldfbidonfeldmalbflbmlebbipcnle Infinity Wallet ellkdbaphhldpeajbepobaecooaoafpg Fetch.ai Network Wallet iokeahhehimjnekafflcihljlcjccdbe Alby Wallet omajpeaffjgmlpmhbfdjepdejoemifpe xBull Wallet pgojdfajgcjjpjnbpfaelnpnjocakldb Sugarchain Wallet pnndplcbkakcplkjnolgbkdgjikjednm Tronium fnnegphlobjdpkhecapkijjdkgcjhkib Harmony fhilaheimglignddkjgofkcbgekhenbh Oxygen cmbagcoinhmacpcgmbiniijboejgiahi JustLiquidity Wallet kmmolakhbgdlpkjkcjkebenjheonagdm AlgoSigner fnabdmcgpkkjjegokfcnfbpneacddpfh Goldmint Lite Wallet bgpipimickeadkjlklgciifhnalhdjhe GeroWallet hoighigmnhgkkdaenafgnefkcmipfjon EO.Finance nlgnepoeokdfodgjkjiblkadkjbdfmgd Multi Wallet nhihjlnjgibefgjhobhcphmnckoogdea Waves Enterprise Wallet ehibhohmlpipbaogcknmpmiibbllplph Bluehelix Wallet magbanejlegnbcppjljfhnmfmghialkl Nebulas Wallet fgkaeeikaoeiiggggbgdcjchmdfmamla Vtimes pnlfjmlcjdjgkddecgincndfgegkecke Crocobit Wallet bhghoamapcdpbohphigoooaddinpkbai Authenticator gaedmjdfmmahhbjefcbgaolhhanlaolb Authy oeljdldpnmdbchonielidgobddffflal EOS Authenticator ilgcnhelpchnceeipipijaljkblbcobl GAuth Authenticator imloifkgjagghnncjkhggdhalmcnfklk Trezor Password Manager %s\%s\Local Extension Settings\%s %s\CURRENT %s\%s\Sync Extension Settings\%s %s\%s\IndexedDB\chrome-extension_%s_0.indexeddb.leveldb Plugins\ HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductName x64 x86 DISPLAY SOFTWARE\Microsoft\Cryptography MachineGuid SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall DisplayName DisplayVersion screenshot.jpg ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890 /c timeout /t 5 & del /f /q "%s" & exit C:\Windows\System32\cmd.exe | |||||||||||||||
Total events
11
Read events
11
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report