| File name: | 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop |
| Full analysis: | https://app.any.run/tasks/9e38837f-f7a9-443e-aab7-81801f40d1e1 |
| Verdict: | Malicious activity |
| Threats: | Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files. |
| Analysis date: | May 17, 2025, 01:13:35 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 09CD1379FF25B6FE56133968B240BC54 |
| SHA1: | C7C9372A04E32AEC865541D603798425EC239022 |
| SHA256: | FF9E9D2EA237623B5ABF0A2C717C93365FB2A84B748380607FBCDEC89EC6D234 |
| SSDEEP: | 6144:UM8ZBq1O9E7J4nhx3fwqKgS8PLIfl1kGT6EZXXXx0T3/ADC+tqBsQadhu/cK7:QZBGyEKba8PLIt1kmHx0T3/Sjv3K7 |
MALICIOUS
ARKEI has been detected (YARA)
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
SUSPICIOUS
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
Reads security settings of Internet Explorer
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
Multiple wallet extension IDs have been found
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
INFO
Reads the machine GUID from the registry
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
Reads the computer name
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
Checks proxy server information
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
- slui.exe (PID: 7600)
Reads the software policy settings
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
- slui.exe (PID: 7600)
Checks supported languages
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
Attempting to use instant messaging service
- 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe (PID: 7324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Arkei
(PID) Process(7324) 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
C2 (2)https://t.me/cahalgo
https://steamcommunity.com/profiles/76561199560322242
Strings (534)kernel32.dll
GetUserNameA
advapi32.dll
GetComputerNameA
LocalAlloc
lstrcmpiW
VirtualFree
VirtualAlloc
VirtualAllocExNuma
GetCurrentProcess
ExitProcess
GetSystemTime
Sleep
GetProcAddress
lstrcatA
LoadLibraryA
JohnDoe
HAL9TH
Ledger Live
\Raven\
Raven Core
\Dogecoin\
Dogecoin
*wallet*.dat
wallet.dat
\Bitcoin\
Bitcoin Core Old
\Bitcoin\wallets\
Bitcoin Core
.finger-print.fp
simple-storage.json
Binance Desktop
loginusers.vdf
libraryfolders.vdf
DialogConfigOverlay*.vdf
DialogConfig.vdf
config.vdf
ssfn*
SteamPath
Software\Valve\Steam
C:\\\Windows\
C:\\Windows\
C:\Windows\
*%DRIVE_REMOVABLE%*
*%DRIVE_FIXED%*
*%RECENT%*
%DRIVE_REMOVABLE%
%DRIVE_FIXED%
%RECENT%
%PROGRAMFILES_86%
%PROGRAMFILES%
%DOCUMENTS%
%DESKTOP%
%USERPROFILE%
%LOCALAPPDATA%
%APPDATA%
\information.txt
[Software]
[Processes]
VideoCard:
RAM:
CPU Count:
Processor:
[Hardware]
TimeZone:
Local Time:
Keyboard Languages:
Display Language:
Display Resolution:
User Name:
Computer Name:
Windows:
Work Dir: In memory
Path:
HWID:
GUID:
MachineID:
Date:
Version:
sqlite3.dll
RoninWalletEdge
kjmoohlgokccodicjjfebfomlbljgfhk
IndexedDB
Sync Extension Settings
Local Extension Settings
UseMasterPassword
Security
Password
UserName
PortNumber
HostName
Soft: WinSCP
\Soft\Authy Desktop\
\Authy Desktop\Local Storage\leveldb\
\Soft\Authy Desktop Old\
\Authy Desktop\Local Storage\
*.localstorage
places.sqlite
formhistory.sqlite
cookies.sqlite
History
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Network
Password:
Login:
Host:
Soft:
"os_crypt":{"encrypted_key":"
\passwords.txt
\Soft\Telegram\
F8806DD0C461824F*
A92DAA6EA6F891F2*
A7FDF864FBC10B77*
D877F783D5D3EF8C*
key_datas
\Telegram Desktop\
Thunderbird
\Thunderbird\Profiles\
Brave
\BraveSoftware\Brave-Browser\User Data\
CryptoTab Browser
\CryptoTab Browser\User Data\
\Opera GX Stable\
\Opera Stable\
\Opera Software\
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_close
sqlite3_finalize
sqlite3_column_text
sqlite3_step
sqlite3_prepare_v2
sqlite3_open
GdipFree
GdipDisposeImage
GdipSaveImageToStream
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipGetImageEncodersSize
SymMatchString
PathFindFileNameA
StrStrA
StrCmpCW
StrCmpCA
PathMatchSpecA
PathMatchSpecW
SHGetFolderPathA
ShellExecuteExA
CloseWindow
GetWindowDC
GetWindowRect
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitialize
InternetCrackUrlA
AccessCheck
MapGenericMask
DuplicateToken
OpenProcessToken
GetFileSecurityA
RegEnumValueA
CryptBinaryToStringA
gdiplus.dll
dbghelp.dll
shlwapi.dll
shell32.dll
GetVolumeInformationA
GetWindowsDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateEventA
OpenEventA
GetTickCount
SetEnvironmentVariableA
GetEnvironmentVariableA
GetFileInformationByHandle
CreateFileMappingA
FileTimeToSystemTime
UnmapViewOfFile
MapViewOfFile
LocalFileTimeToFileTime
GetFileAttributesW
GetFileAttributesA
WriteFile
SetFileTime
GetLocalTime
SystemTimeToFileTime
HeapFree
SetFilePointer
GetCurrentDirectoryA
DeleteFileA
CopyFileA
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
GetFileSizeEx
OpenProcess
GetCurrentProcessId
GetLocaleInfoA
FreeLibrary
GlobalSize
GlobalLock
lstrcpynA
GetLastError
FindClose
FindNextFileA
FindFirstFileA
MultiByteToWideChar
lstrcpyA
GetDriveTypeA
lstrlenA
GetLogicalDriveStringsA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetProcessHeap
HeapAlloc
LocalFree
WideCharToMultiByte
GetSystemInfo
GetUserDefaultLocaleName
BopT?O
IsWow64Process
GlobalMemoryStatusEx
CreateThread
Discord Token:
dQw4w9WgXcQ:
\Soft\Discord\discord_tokens.txt
Session Storage
leveldb
Local Storage
Discord
\discord\
Wasabi Wallet
\WalletWasabi\Client\Wallets\
Blockstream Green
\Blockstream\Green\wallets\
she*.sqlite
Daedalus Mainnet
\Daedalus Mainnet\wallets\
Jaxx_Desktop
\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
GAuth Authenticator
ilgcnhelpchnceeipipijaljkblbcobl
EOS Authenticator
oeljdldpnmdbchonielidgobddffflal
Authy
gaedmjdfmmahhbjefcbgaolhhanlaolb
Authenticator
bhghoamapcdpbohphigoooaddinpkbai
jnkelfanjkeadonecabehalmbgpfodjm
Temple
ookjlbkiijinhpmnjffcofjonbfbgaoc
TezBox
mnfifefkajgofkcjkemidiaecocnkjeh
hcflpincpppdclinealmandijcmnkbgn
CyanoWallet
dkdedlpgdmmkkfjabffeganieamfklkm
Solflare
bhhhlbepdkbapadjdnnojkbgioiodbic
WavesKeeper
lpilbniiabackdjcionkobglmddfbcjo
MaiarDeFiWallet
dngmlblcodfobpdpecaadgfbcggfjfnm
NamiWallet
lpfcbjknijpeeillifnkikgncikgfhdo
XdefiWallet
hmeobnfnfcmdkdcmlblgagmfpfboieaf
BoltX
aodkkagnadcbobfpggfnjeongemjbjca
PaliWallet
mgffkfbidihjpoaomajlbgchddlicgpn
Oxygen (Atomic)
fhilaheimglignddkjgofkcbgekhenbh
BraveWallet
odbfpeeihdkbihmopkbjmoonfanlbfcl
ejbalbakoplchlghecdalmeeeajnimhm
Phantom
bfnaelmomeimhlpmgjnjophhpkkoljpa
Rabby
acmacodkjbdgmoleebolmdjonilkdbch
Trezor Password Manager
imloifkgjagghnncjkhggdhalmcnfklk
KardiaChain
pdadjkfkgcafgbceimcpbkalnfnepbnk
EVER Wallet
cgeeodpfagjceefieflmdfphplkenlfk
Coin98
aeachknmefphepccionboohckonoeemg
Harmony
fnnegphlobjdpkhecapkijjdkgcjhkib
ICONex
flpiciilemghbmfalicajoolhkkenfel
PolymeshWallet
jojhfeoedkpkglbfimdfabpdfjaoolaf
AuroWallet
cnmamaachppnkjgnildpdmkaakejnhae
Sollet
fhmfendgdocmcbmfikdcogofphimnkno
Keplr
dmkamcknogkgcdfhhbddcghachkejeap
Terra_Station
aiifbnbfobpmeekipheeijimdpnlpgpp
LiqualityWallet
kpfopkelmapcoipemfendmdcghnegimn
CloverWallet
nhnkbkgjikgcigadomkphalanndcapjk
NeoLine
cphhlgmgameodnhkjdmkpanlelnlohao
RoninWallet
fnjhmkhhmkbjkkabndcnnogagogbneec
GuildWallet
nanjmdknhkinifnkgdcggcfnhdaammmj
MewCx
nlbmnnijcnlegkjjpcfjclmcfggfefdm
Wombat
amkmjjmmflddogmhpjloimipbofnfjih
iWallet
kncchdigobghenbbaddojjnnaogfppfj
BitAppWallet
fihkakfobkmkjojpchpfgcmhfjnmnfpi
JaxxLiberty
cjelfplplebdjjenllpjcblmjkfcffne
EQUALWallet
blnieiiffboillknjnepogjhkgnoapac
Guarda
hpglfhgfnhbgpjdenjgmdgoeiappafln
Coinbase
hnfanknocfeofbddgcijnmhnfnkdnaad
MathWallet
afbcbjpbpfadlkmhmclhkeeodmamcflc
NiftyWallet
jbdaocneiiinmjbjlgalhcelgbejmnid
Yoroi
ffnbelfdoeiohenkjibnmadjiehjhajb
BinanceChainWallet
fhbohimaelbohpjbbldcngcnapndodjp
MetaMask
nkbihfbeogaeaoehlefnkodbefgpgknn
TronLink
ibnejdfjmmkpcnlpebklmnkoeoihofec
EnumProcessModules
GetModuleBaseNameA
GetModuleFileNameExA
GetSystemMetrics
EnumDisplayDevicesA
wsprintfA
GetDC
CharToOemA
GetKeyboardLayoutList
ReleaseDC
GetDesktopWindow
CoUninitialize
CoCreateInstance
CreateCompatibleDC
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SelectObject
l`ax1
CreateCompatibleBitmap
DeleteUrlCacheEntry
InternetSetOptionA
InternetOpenUrlA
InternetSetFilePointer
HttpQueryInfoA
HttpAddRequestHeadersA
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetReadFile
InternetCloseHandle
wininet.dll
GetCurrentHwProfileA
RegGetValueA
RegEnumKeyExA
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
PK11SDR_Decrypt
PK11_Authenticate
PK11_FreeSlot
PK11_GetInternalKeySlot
NSS_Shutdown
NSS_Init
C:\ProgramData\nss3.dll
CryptStringToBinaryA
CryptUnprotectData
CRYPT32.DLL
BCryptDecrypt
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCRYPT.DLL
psapi.dll
user32.dll
ole32.dll
gdi32.dll
FALSE
Cookies
Local State
\Opera Software\Opera GX Stable\
OperaGX
\Opera Software\Opera Stable\
Opera
\Tencent\QQBrowser\User Data\
QQBrowser
\360Browser\Browser\User Data\
360 Browser
\Microsoft\Edge\User Data\
Microsoft Edge
\7Star\7Star\User Data\
7Star
\brave\
Brave_Old
\Chedot\User Data\
Chedot Browser
\TorBro\Profile\
TorBro Browser
\CentBrowser\User Data\
Cent Browser
\CocCoc\Browser\User Data\
CocCoc
\Vivaldi\User Data\
Vivaldi
\Epic Privacy Browser\User Data\
Epic Privacy Browser
\Comodo\Dragon\User Data\
Comodo Dragon
\Torch\User Data\
Torch
\Amigo\User Data\
Amigo
\Chromium\User Data\
Chromium
\Google\Chrome\User Data\
Google Chrome
\Moonchild Productions\Pale Moon\Profiles\
Pale Moon
\Mozilla\Firefox\Profiles\
Mozilla Firefox
Soft: FileZilla
<Pass encoding="base64">
<User>
<Port>
<Host>
\AppData\Roaming\FileZilla\recentservers.xml
SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
SELECT url FROM urls
SELECT target_path, tab_url from downloads
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
SELECT name, value FROM autofill
SELECT origin_url, username_value, password_value FROM logins
encryptedPassword
encryptedUsername
usernameField
formSubmitURL
logins.json
Web Data
Cookies
Login Data
netfulfilled
mnpayments
mncache
governance
banlist
mempool
peers
fee_estimates
Local\Microsoft
Roaming\WinRAR
Local\NuGet
Local\Packages
MicrosoftEdge\Cookies
Recycle.Bin
Local\Temp
Recovery
msdownld.tmp
System Volume Information
Config.Msi
RECYCLE.BIN
C:\ProgramData\
\Monero\
SOFTWARE\monero-project\monero-core
wallet_path
*.config
*.wallet
\Coinomi\Coinomi\wallets\
Coinomi
app-store.json
\Binance\
Binance
0000*
MANIFEST-000001
CURRENT
*.log
\atomic\Local Storage\leveldb\
Atomic
file__0.localstorage
\jaxx\Local Storage\
Jaxx_Desktop_Old
multidoge.wallet
\MultiDoge\
MultiDoge
default_wallet
\ElectronCash\wallets\
ElectronCash
info.seco
seed.seco
passphrase.json
\Exodus\exodus.wallet\
window-state.json
exodus.conf.json
\Exodus\
Exodus
\Electrum-LTC\wallets\
ElectrumLTC
\Electrum\wallets\
Electrum
\Ethereum\
Ethereum"
keystore
Plugins
Wallets
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:08:15 23:35:45+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 337408 |
| InitializedDataSize: | 31808000 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x4d8b |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 54.0.0.0 |
| ProductVersionNumber: | 50.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Unknown (0274) |
| CharacterSet: | Unknown (85B3) |
| InternalName: | ElasticAttribs.exe |
| LegalTrademark1: | DoesGet |
| OriginalFileName: | Huklus.exe |
| ProductName: | Jsdgsdfu |
| ProductVersion: | 49.6.86.89 |
Total processes
120
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 7324 | "C:\Users\admin\Desktop\2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe" | C:\Users\admin\Desktop\2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
Arkei(PID) Process(7324) 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe C2 (2)https://t.me/cahalgo https://steamcommunity.com/profiles/76561199560322242 Strings (534)kernel32.dll GetUserNameA advapi32.dll GetComputerNameA LocalAlloc lstrcmpiW VirtualFree VirtualAlloc VirtualAllocExNuma GetCurrentProcess ExitProcess GetSystemTime Sleep GetProcAddress lstrcatA LoadLibraryA JohnDoe HAL9TH Ledger Live \Raven\ Raven Core \Dogecoin\ Dogecoin *wallet*.dat wallet.dat \Bitcoin\ Bitcoin Core Old \Bitcoin\wallets\ Bitcoin Core .finger-print.fp simple-storage.json Binance Desktop loginusers.vdf libraryfolders.vdf DialogConfigOverlay*.vdf DialogConfig.vdf config.vdf ssfn* SteamPath Software\Valve\Steam C:\\\Windows\ C:\\Windows\ C:\Windows\ *%DRIVE_REMOVABLE%* *%DRIVE_FIXED%* *%RECENT%* %DRIVE_REMOVABLE% %DRIVE_FIXED% %RECENT% %PROGRAMFILES_86% %PROGRAMFILES% %DOCUMENTS% %DESKTOP% %USERPROFILE% %LOCALAPPDATA% %APPDATA% \information.txt [Software] [Processes] VideoCard: RAM: CPU Count: Processor: [Hardware] TimeZone: Local Time: Keyboard Languages: Display Language: Display Resolution: User Name: Computer Name: Windows: Work Dir: In memory Path: HWID: GUID: MachineID: Date: Version: sqlite3.dll RoninWalletEdge kjmoohlgokccodicjjfebfomlbljgfhk IndexedDB Sync Extension Settings Local Extension Settings UseMasterPassword Security Password UserName PortNumber HostName Soft: WinSCP \Soft\Authy Desktop\ \Authy Desktop\Local Storage\leveldb\ \Soft\Authy Desktop Old\ \Authy Desktop\Local Storage\ *.localstorage places.sqlite formhistory.sqlite cookies.sqlite History SELECT fieldname, value FROM moz_formhistory SELECT url FROM moz_places SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies Network Password: Login: Host: Soft: "os_crypt":{"encrypted_key":" \passwords.txt \Soft\Telegram\ F8806DD0C461824F* A92DAA6EA6F891F2* A7FDF864FBC10B77* D877F783D5D3EF8C* key_datas \Telegram Desktop\ Thunderbird \Thunderbird\Profiles\ Brave \BraveSoftware\Brave-Browser\User Data\ CryptoTab Browser \CryptoTab Browser\User Data\ \Opera GX Stable\ \Opera Stable\ \Opera Software\ sqlite3_column_blob sqlite3_column_bytes sqlite3_close sqlite3_finalize sqlite3_column_text sqlite3_step sqlite3_prepare_v2 sqlite3_open GdipFree GdipDisposeImage GdipSaveImageToStream GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipGetImageEncodersSize SymMatchString PathFindFileNameA StrStrA StrCmpCW StrCmpCA PathMatchSpecA PathMatchSpecW SHGetFolderPathA ShellExecuteExA CloseWindow GetWindowDC GetWindowRect GetHGlobalFromStream CreateStreamOnHGlobal CoInitialize InternetCrackUrlA AccessCheck MapGenericMask DuplicateToken OpenProcessToken GetFileSecurityA RegEnumValueA CryptBinaryToStringA gdiplus.dll dbghelp.dll shlwapi.dll shell32.dll GetVolumeInformationA GetWindowsDirectoryA Process32Next Process32First CreateToolhelp32Snapshot CreateEventA OpenEventA GetTickCount SetEnvironmentVariableA GetEnvironmentVariableA GetFileInformationByHandle CreateFileMappingA FileTimeToSystemTime UnmapViewOfFile MapViewOfFile LocalFileTimeToFileTime GetFileAttributesW GetFileAttributesA WriteFile SetFileTime GetLocalTime SystemTimeToFileTime HeapFree SetFilePointer GetCurrentDirectoryA DeleteFileA CopyFileA TzSpecificLocalTimeToSystemTime GetTimeZoneInformation GetFileSizeEx OpenProcess GetCurrentProcessId GetLocaleInfoA FreeLibrary GlobalSize GlobalLock lstrcpynA GetLastError FindClose FindNextFileA FindFirstFileA MultiByteToWideChar lstrcpyA GetDriveTypeA lstrlenA GetLogicalDriveStringsA CloseHandle ReadFile GetFileSize CreateFileA GetProcessHeap HeapAlloc LocalFree WideCharToMultiByte GetSystemInfo GetUserDefaultLocaleName BopT?O IsWow64Process GlobalMemoryStatusEx CreateThread Discord Token: dQw4w9WgXcQ: \Soft\Discord\discord_tokens.txt Session Storage leveldb Local Storage Discord \discord\ Wasabi Wallet \WalletWasabi\Client\Wallets\ Blockstream Green \Blockstream\Green\wallets\ she*.sqlite Daedalus Mainnet \Daedalus Mainnet\wallets\ Jaxx_Desktop \com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\ GAuth Authenticator ilgcnhelpchnceeipipijaljkblbcobl EOS Authenticator oeljdldpnmdbchonielidgobddffflal Authy gaedmjdfmmahhbjefcbgaolhhanlaolb Authenticator bhghoamapcdpbohphigoooaddinpkbai jnkelfanjkeadonecabehalmbgpfodjm Temple ookjlbkiijinhpmnjffcofjonbfbgaoc TezBox mnfifefkajgofkcjkemidiaecocnkjeh hcflpincpppdclinealmandijcmnkbgn CyanoWallet dkdedlpgdmmkkfjabffeganieamfklkm Solflare bhhhlbepdkbapadjdnnojkbgioiodbic WavesKeeper lpilbniiabackdjcionkobglmddfbcjo MaiarDeFiWallet dngmlblcodfobpdpecaadgfbcggfjfnm NamiWallet lpfcbjknijpeeillifnkikgncikgfhdo XdefiWallet hmeobnfnfcmdkdcmlblgagmfpfboieaf BoltX aodkkagnadcbobfpggfnjeongemjbjca PaliWallet mgffkfbidihjpoaomajlbgchddlicgpn Oxygen (Atomic) fhilaheimglignddkjgofkcbgekhenbh BraveWallet odbfpeeihdkbihmopkbjmoonfanlbfcl ejbalbakoplchlghecdalmeeeajnimhm Phantom bfnaelmomeimhlpmgjnjophhpkkoljpa Rabby acmacodkjbdgmoleebolmdjonilkdbch Trezor Password Manager imloifkgjagghnncjkhggdhalmcnfklk KardiaChain pdadjkfkgcafgbceimcpbkalnfnepbnk EVER Wallet cgeeodpfagjceefieflmdfphplkenlfk Coin98 aeachknmefphepccionboohckonoeemg Harmony fnnegphlobjdpkhecapkijjdkgcjhkib ICONex flpiciilemghbmfalicajoolhkkenfel PolymeshWallet jojhfeoedkpkglbfimdfabpdfjaoolaf AuroWallet cnmamaachppnkjgnildpdmkaakejnhae Sollet fhmfendgdocmcbmfikdcogofphimnkno Keplr dmkamcknogkgcdfhhbddcghachkejeap Terra_Station aiifbnbfobpmeekipheeijimdpnlpgpp LiqualityWallet kpfopkelmapcoipemfendmdcghnegimn CloverWallet nhnkbkgjikgcigadomkphalanndcapjk NeoLine cphhlgmgameodnhkjdmkpanlelnlohao RoninWallet fnjhmkhhmkbjkkabndcnnogagogbneec GuildWallet nanjmdknhkinifnkgdcggcfnhdaammmj MewCx nlbmnnijcnlegkjjpcfjclmcfggfefdm Wombat amkmjjmmflddogmhpjloimipbofnfjih iWallet kncchdigobghenbbaddojjnnaogfppfj BitAppWallet fihkakfobkmkjojpchpfgcmhfjnmnfpi JaxxLiberty cjelfplplebdjjenllpjcblmjkfcffne EQUALWallet blnieiiffboillknjnepogjhkgnoapac Guarda hpglfhgfnhbgpjdenjgmdgoeiappafln Coinbase hnfanknocfeofbddgcijnmhnfnkdnaad MathWallet afbcbjpbpfadlkmhmclhkeeodmamcflc NiftyWallet jbdaocneiiinmjbjlgalhcelgbejmnid Yoroi ffnbelfdoeiohenkjibnmadjiehjhajb BinanceChainWallet fhbohimaelbohpjbbldcngcnapndodjp MetaMask nkbihfbeogaeaoehlefnkodbefgpgknn TronLink ibnejdfjmmkpcnlpebklmnkoeoihofec EnumProcessModules GetModuleBaseNameA GetModuleFileNameExA GetSystemMetrics EnumDisplayDevicesA wsprintfA GetDC CharToOemA GetKeyboardLayoutList ReleaseDC GetDesktopWindow CoUninitialize CoCreateInstance CreateCompatibleDC GetDeviceCaps CreateDCA DeleteObject BitBlt SelectObject l`ax1 CreateCompatibleBitmap DeleteUrlCacheEntry InternetSetOptionA InternetOpenUrlA InternetSetFilePointer HttpQueryInfoA HttpAddRequestHeadersA InternetOpenA InternetConnectA HttpOpenRequestA InternetReadFile InternetCloseHandle wininet.dll GetCurrentHwProfileA RegGetValueA RegEnumKeyExA RegGetValueW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA PK11SDR_Decrypt PK11_Authenticate PK11_FreeSlot PK11_GetInternalKeySlot NSS_Shutdown NSS_Init C:\ProgramData\nss3.dll CryptStringToBinaryA CryptUnprotectData CRYPT32.DLL BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptCloseAlgorithmProvider BCRYPT.DLL psapi.dll user32.dll ole32.dll gdi32.dll FALSE Cookies Local State \Opera Software\Opera GX Stable\ OperaGX \Opera Software\Opera Stable\ Opera \Tencent\QQBrowser\User Data\ QQBrowser \360Browser\Browser\User Data\ 360 Browser \Microsoft\Edge\User Data\ Microsoft Edge \7Star\7Star\User Data\ 7Star \brave\ Brave_Old \Chedot\User Data\ Chedot Browser \TorBro\Profile\ TorBro Browser \CentBrowser\User Data\ Cent Browser \CocCoc\Browser\User Data\ CocCoc \Vivaldi\User Data\ Vivaldi \Epic Privacy Browser\User Data\ Epic Privacy Browser \Comodo\Dragon\User Data\ Comodo Dragon \Torch\User Data\ Torch \Amigo\User Data\ Amigo \Chromium\User Data\ Chromium \Google\Chrome\User Data\ Google Chrome \Moonchild Productions\Pale Moon\Profiles\ Pale Moon \Mozilla\Firefox\Profiles\ Mozilla Firefox Soft: FileZilla <Pass encoding="base64"> <User> <Port> <Host> \AppData\Roaming\FileZilla\recentservers.xml SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies SELECT url FROM urls SELECT target_path, tab_url from downloads SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards SELECT name, value FROM autofill SELECT origin_url, username_value, password_value FROM logins encryptedPassword encryptedUsername usernameField formSubmitURL logins.json Web Data Cookies Login Data netfulfilled mnpayments mncache governance banlist mempool peers fee_estimates Local\Microsoft Roaming\WinRAR Local\NuGet Local\Packages MicrosoftEdge\Cookies Recycle.Bin Local\Temp Recovery msdownld.tmp System Volume Information Config.Msi RECYCLE.BIN C:\ProgramData\ \Monero\ SOFTWARE\monero-project\monero-core wallet_path *.config *.wallet \Coinomi\Coinomi\wallets\ Coinomi app-store.json \Binance\ Binance 0000* MANIFEST-000001 CURRENT *.log \atomic\Local Storage\leveldb\ Atomic file__0.localstorage \jaxx\Local Storage\ Jaxx_Desktop_Old multidoge.wallet \MultiDoge\ MultiDoge default_wallet \ElectronCash\wallets\ ElectronCash info.seco seed.seco passphrase.json \Exodus\exodus.wallet\ window-state.json exodus.conf.json \Exodus\ Exodus \Electrum-LTC\wallets\ ElectrumLTC \Electrum\wallets\ Electrum \Ethereum\ Ethereum" keystore Plugins Wallets | |||||||||||||||
| 7600 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
6 754
Read events
6 751
Write events
3
Delete events
0
Modification events
| (PID) Process: | (7324) 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7324) 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7324) 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
25
DNS requests
5
Threats
2
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7324 | 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe | 149.154.167.99:443 | t.me | Telegram Messenger Inc | GB | whitelisted |
7324 | 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe | 23.197.130.99:443 | steamcommunity.com | Akamai International B.V. | US | whitelisted |
7184 | slui.exe | 20.83.72.98:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7600 | slui.exe | 20.83.72.98:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
t.me |
| whitelisted |
steamcommunity.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7324 | 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe | Misc activity | ET INFO Observed Telegram Domain (t .me in TLS SNI) |
7324 | 2025-05-17_09cd1379ff25b6fe56133968b240bc54_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe | Misc activity | ET INFO Observed Telegram Domain (t .me in TLS SNI) |