Overview

overview

7

Static

static

3

2026-08-03...er.exe

windows10-2004-x64

7

2026-08-03...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 08:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_f807dc419cc1de6e30491ec25bef4c17_amadey_elex_smoke-loader.exe
  • Size 60.2MB
  • Sample260804-ktbbsswcnf
  • SHA256 8f4dcc989999fa7e64e6eba37302489f6cc50aff9d4ac8ebcba8c56c14ca939d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoveryexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes to the Master Boot Record (MBR) 1 TTPs 15 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 63 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_f807dc419cc1de6e30491ec25bef4c17_amadey_elex_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_f807dc419cc1de6e30491ec25bef4c17_amadey_elex_smoke-loader.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c set
      2⤵
      • Executes a command shell one-liner
      PID:3512
    • C:\Users\Admin\AppData\Local\Temp\~354063292178873774~\sg.tmp
      7zG_exe x "C:\Users\Admin\AppData\Local\Temp\2026-08-03_f807dc419cc1de6e30491ec25bef4c17_amadey_elex_smoke-loader.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~7730501296164147470"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
    • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
      "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --type=utility --field-trial-handle=3120,9551626343751865566,15378875818877382854,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --no-sandbox --mojo-platform-channel-handle=3128 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:4304
      • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3120,9551626343751865566,15378875818877382854,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app" --node-integration --webview-tag --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app/out/common-preload.js" --enable-remote-module --background-color=#FFF --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3084 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\bin\SDK\DownloadSDKServer.exe
          "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\bin\SDK\DownloadSDKServer.exe" BDAF7A63-568C-43ab-9406-D145CF03B08C:2000
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:1008
        • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/plugins/VipDownload/config.json --xdas-plugin-name=VipDownload
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2788
        • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/plugins/VipPluginController/config.json --xdas-plugin-name=VipPluginController
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2936
        • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/plugins/User/config.json --xdas-plugin-name=User
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2656
        • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/plugins/ThunderPanPlugin/config.json --xdas-plugin-name=ThunderPanPlugin
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1076
        • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~7730501296164147470/Program/resources/app/plugins/XmpPlugin/config.json --xdas-plugin-name=XmpPlugin
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          PID:4764
        • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\plugins\XmpPlugin\0.0.7\bin\APlayer.exe
          "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\plugins\XmpPlugin\0.0.7\bin\APlayer.exe" --server-id="XmplitePlayer" --client-id="XmpPlayerAplayer" --process-id=2000
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          PID:5204
        • C:\Windows\SysWOW64\ping.exe
          C:\Windows/system32/ping.exe -w 5000 -n 1 hub5u.sandai.net
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1284
        • C:\Windows\SysWOW64\ping.exe
          C:\Windows/system32/ping.exe -w 5000 -n 1 hub5pn.sandai.net
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5828
      • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3120,9551626343751865566,15378875818877382854,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\plugin-boot.js" --enable-remote-module --background-color=#fff --guest-instance-id=3 --enable-blink-features --disable-blink-features --enable-spellcheck --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4148 /prefetch:1
        3⤵
        • Executes dropped EXE
        PID:1260
      • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3120,9551626343751865566,15378875818877382854,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\plugin-boot.js" --enable-remote-module --background-color=#fff --guest-instance-id=3 --enable-blink-features --disable-blink-features --enable-spellcheck --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4152 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2404
      • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3120,9551626343751865566,15378875818877382854,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app/out/common-preload.js" --enable-remote-module --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4200 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4648
      • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3120,9551626343751865566,15378875818877382854,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app/out/common-preload.js" --enable-remote-module --background-color=#0000 --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4288 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        PID:2516
      • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3120,9551626343751865566,15378875818877382854,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\plugin-boot.js" --enable-remote-module --background-color=#fff --guest-instance-id=5 --enable-blink-features --disable-blink-features --enable-spellcheck --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4400 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:1708
      • C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3120,9551626343751865566,15378875818877382854,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\plugin-boot.js" --enable-remote-module --background-color=#fff --guest-instance-id=5 --enable-blink-features --disable-blink-features --enable-spellcheck --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4404 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:1864

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Privilege Escalation

        Defense Evasion

        Modify Registry

        1
        T1112

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Subvert Trust Controls

        1
        T1553

        Install Root Certificate

        1
        T1553.004

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        Remote System Discovery

        1
        T1018

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        pub_store.dat
        • Path C:\ProgramData\Thunder Network\DownloadLib\pub_store.dat
        • Size 133B
        • SHA256 eb43d5b5b7d5b37e84a75159e121550a306fcea89dc26335f1838d02b80f5e45
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        crashinfo.ini
        • Path C:\Users\Admin\AppData\Local\Temp\Thunder Network\xl11\crashinfo.ini
        • Size 34B
        • SHA256 6477c070a9dfbdf1890dc1d173a78c44abf0fc9154a61d7fb3945074e258d616
        • MD5 SHA1 SHA512
        Submit Download

        sg.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~354063292178873774~\sg.tmp
        • Size 715KB
        • SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Thunder.exe
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\Thunder.exe
        • Size 607KB
        • SHA256 0eec405c42213aa6bc5926d15c65041fd04bfe833bbdd3420cd5abc266ea6cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        XLBugHandler.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\XLBugHandler.dll
        • Size 574KB
        • SHA256 c7ef10c5fd6ab171ca801e76b178dc6ce9b881712f16ba81cdd15463886a4ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\ffmpeg.dll
        • Size 2.5MB
        • SHA256 61f328957e35103d2177eb90f3c17d1af1017883bf73592e7165ff996135e3a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\icudtl.dat
        • Size 10.0MB
        • SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        latest_thunder_stat.xml
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\latest_thunder_stat.xml
        • Size 1KB
        • SHA256 4c92e2ca3ff29886143a0138bb5e211810cb2fe926f29d7ade2bda93f29f0a63
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libexpat.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\libexpat.dll
        • Size 409KB
        • SHA256 181903fb256b663789c4056912061f90bf8628b14cb83c9c8e2929bad64468b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\locales\en-US.pak
        • Size 76KB
        • SHA256 6d9baf2f803f792c09fc4764c134a479b98d7b4644c88789c1f4b086a9edb0c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        minizip.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\minizip.dll
        • Size 144KB
        • SHA256 788467a9c7d8f54aed0630c349eb84329ea2d228cfa110b35c6d86beb87579be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources.pak
        • Size 4.3MB
        • SHA256 4ecce7518fdc0435a8cdfd3c64face116a10bfcde0a8e9b3f1ae31ef515f948c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        common-preload.js
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\common-preload.js
        • Size 3KB
        • SHA256 aaa333a6daec927634bbd1baf4224b01ff10e0c02c6d9b615360bba55c2bd1b3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        common-style.css
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\common-style.css
        • Size 52KB
        • SHA256 9fa0778158395cd2aad040ed4c04447f9a27b60ac419625503c753e69172f7a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.html
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\main-renderer\index.html
        • Size 3KB
        • SHA256 e25957459af9ecd100d83fe1769ef1a32f4a833e532f6592804efe7a953d67ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        renderer.css
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\main-renderer\renderer.css
        • Size 1.0MB
        • SHA256 f4e1126805cdb5594be85b8d8aa13efb18620af26a1652b54895d28a2a9cedec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        renderer.js
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\main-renderer\renderer.js
        • Size 6.1MB
        • SHA256 ebc9b72b83cee7ddff1a1e8ed706bffc501c1d84e149efe4a82a244252dadca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.js
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\main.js
        • Size 354KB
        • SHA256 28e2e8b7e49bdaf67553d40d62d4580324809d45b0fb30291585e13946f6df80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        renderer.css
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\pre-new-task-renderer\renderer.css
        • Size 222KB
        • SHA256 14f7f890320e9fbd9870f6a0a351f2b8b26515a8842aabec81f272d95e08822c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        renderer.css
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\search-renderer\renderer.css
        • Size 206KB
        • SHA256 afcb79e2bd98de2dcccb0e3376ecc5c62c0a7d99955232cb3b157e3ab99e1676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        skeleton.js
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\skeleton.js
        • Size 5KB
        • SHA256 a9c20e1fd485d35ff592eca076be37643ccfa9851e4ea666fec26938baea79cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vendor.js
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\out\vendor.js
        • Size 259KB
        • SHA256 380d57b2261009d0e86923498e112ef0f89a4c66cc5d1ca10ec48889078f28e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package.json
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\package.json
        • Size 124B
        • SHA256 b15714ad1ace355c9aaa770916f2bca6848e4d3bd7520284c6c415f3a64162ce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        spr-browser.87d9c5e.png
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\plugins\ThunderXWebXDAS\versions\4.8.4\_nuxt\img\spr-browser.87d9c5e.png
        • Size 1KB
        • SHA256 3ebc93bdfa32b599d07a965d0cfef672a31094b1956146be88b1f5e14eface19
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        icon-vip.png
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\plugins\VipDownload\4.5.2\static\img\icon-vip.png
        • Size 2KB
        • SHA256 de27b206929e520d72dadc0017f044e9ba68ac584f88daeea3c51aa426f49e18
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bg-music.png
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\plugins\XmpPlugin\0.0.7\imgs\bg-music.png
        • Size 162KB
        • SHA256 f18d61cdc92a3c22b205759fdd41f30b0f22e40dbfdfca46340c0152f3c59cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        renderer.css
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\plugins\XmpPlugin\0.0.7\message-box-renderer\renderer.css
        • Size 74KB
        • SHA256 65e2201996f773b4a2003f367b16ae2504b58a0fb58bd686ec9a155dd22488bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thunder11.ico
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\app\static\thunder11.ico
        • Size 151KB
        • SHA256 17f79f9ebea97780ac62722e9ca079bc481a16726d4f56aec0006163cf192fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ThunderHelper.node
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\bin\ThunderHelper.node
        • Size 999KB
        • SHA256 d8f8ef764bdd7861e34595ba31e26eb01d321f0fcabaebcaace82d066a0080ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ThunderKernel.node
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\bin\ThunderKernel.node
        • Size 1.2MB
        • SHA256 28669f6a8b1da7d6cc6cdaca760a22670bacfd71171239b843b74dea98c12386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ThunderNewTask.node
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\resources\bin\ThunderNewTask.node
        • Size 143KB
        • SHA256 cdc05b4372ed60f4370cfef9d407688a859471501eaa1526d99c4c543781cdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stat.dat
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\stat.dat
        • Size 917B
        • SHA256 f92f664de28ef222c78e1a440ecd6c85274256be409dd0598b5e73fd194f6d37
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stat.dat
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\stat.dat
        • Size 8B
        • SHA256 9bd4e7da69e147e60c9d5d9124a0c57ef34363668a3b97e42c618d0756eafb7e
        • MD5 SHA1 SHA512
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\v8_context_snapshot.bin
        • Size 166KB
        • SHA256 87b1ea557a0c92272e8b52d9bae44769164717e57a649c67b0ed80f17998faff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xlstat4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\xlstat4.dll
        • Size 567KB
        • SHA256 07d5251432c2192a911f103802a0aeb22f6eaf8bc16c844772c168b3cf28af62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\Program\zlib1.dll
        • Size 431KB
        • SHA256 18618480bc15ffbf1c4a19e1b90050f65a5de04e611d34d9c882df45a78e6bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mainWndData.ini
        • Path C:\Users\Admin\AppData\Local\Temp\~7730501296164147470\profiles\mainWndData.ini
        • Size 93B
        • SHA256 6fe2055b47ae5f3aad7c11b5fbb647f7db427fbf69e92f5e09a43936b6e63447
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        00379b07-1388-434b-aaaf-7ed2b5dd808f.tmp
        • Path C:\Users\Admin\AppData\Roaming\thunder\00379b07-1388-434b-aaaf-7ed2b5dd808f.tmp
        • Size 590B
        • SHA256 8f29c76f058c68a3c7f3abd4ed0b19c7c2581b0355f4c9670139e3b2699d97b8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        38e418c2-42f4-4e54-adbf-7f1321989f90.tmp
        • Path C:\Users\Admin\AppData\Roaming\thunder\38e418c2-42f4-4e54-adbf-7f1321989f90.tmp
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        en-US-9-0.bdic
        • Path C:\Users\Admin\AppData\Roaming\thunder\Dictionaries\en-US-9-0.bdic
        • Size 441KB
        • SHA256 0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Network Persistent State~RFe58bb2d.TMP
        • Path C:\Users\Admin\AppData\Roaming\thunder\Network Persistent State~RFe58bb2d.TMP
        • Size 59B
        • SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Roaming\thunder\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        GlobalSetting.ini
        • Path C:\Users\Public\Thunder Network\DownloadSDK\Profiles\pc.thunderX\GlobalSetting.ini
        • Size 404B
        • SHA256 e0ca6a13e52729eb3783ee2e09a413e5cfc23bdce0964d7737876daa3450e9c7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GlobalSetting.ini
        • Path C:\Users\Public\Thunder Network\DownloadSDK\Profiles\pc.thunderX\GlobalSetting.ini
        • Size 2KB
        • SHA256 ea2bcb7280a65c2a3c2e03c3fe3428beb2bb23562c3d5a38b30dee349ff9fd55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1008-1543-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/1076-1592-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/1076-1594-0x0000000004980000-0x00000000049A4000-memory.dmp
        Download

        memory/1076-1562-0x0000000002E60000-0x0000000002F41000-memory.dmp
        Download

        memory/1076-1675-0x0000000000EE0000-0x0000000000F08000-memory.dmp
        Download

        memory/1708-1618-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/1708-1611-0x0000000002E70000-0x0000000002F51000-memory.dmp
        Download

        memory/1708-1682-0x00000000010D0000-0x00000000010F8000-memory.dmp
        Download

        memory/1864-1641-0x0000000005610000-0x0000000005634000-memory.dmp
        Download

        memory/1864-1704-0x0000000000EE0000-0x0000000000F08000-memory.dmp
        Download

        memory/1864-1626-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/1864-1619-0x0000000002B50000-0x0000000002C31000-memory.dmp
        Download

        memory/2000-1687-0x0000000001140000-0x0000000001168000-memory.dmp
        Download

        memory/2000-1486-0x0000000005A40000-0x0000000005A64000-memory.dmp
        Download

        memory/2000-1472-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/2000-1458-0x0000000002ED0000-0x0000000002FB1000-memory.dmp
        Download

        memory/2404-1701-0x0000000000E40000-0x0000000000E68000-memory.dmp
        Download

        memory/2404-1591-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/2404-1584-0x0000000002900000-0x00000000029E1000-memory.dmp
        Download

        memory/2404-1608-0x00000000053A0000-0x00000000053C4000-memory.dmp
        Download

        memory/2516-1576-0x0000000000E40000-0x0000000000F21000-memory.dmp
        Download

        memory/2516-1583-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/2516-1703-0x0000000002C50000-0x0000000002C78000-memory.dmp
        Download

        memory/2516-1596-0x00000000057C0000-0x00000000057E4000-memory.dmp
        Download

        memory/2656-1532-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/2656-1546-0x0000000004280000-0x00000000042A4000-memory.dmp
        Download

        memory/2656-1526-0x0000000002820000-0x0000000002901000-memory.dmp
        Download

        memory/2656-1697-0x0000000000D80000-0x0000000000DA8000-memory.dmp
        Download

        memory/2788-1548-0x0000000004300000-0x0000000004324000-memory.dmp
        Download

        memory/2788-1673-0x0000000000E10000-0x0000000000E38000-memory.dmp
        Download

        memory/2936-1516-0x0000000003080000-0x0000000003161000-memory.dmp
        Download

        memory/2936-1696-0x0000000003000000-0x0000000003028000-memory.dmp
        Download

        memory/2936-1524-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/2936-1544-0x0000000004D10000-0x0000000004D34000-memory.dmp
        Download

        memory/4304-1445-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/4304-1436-0x0000000002720000-0x0000000002801000-memory.dmp
        Download

        memory/4304-1686-0x0000000000F00000-0x0000000000F28000-memory.dmp
        Download

        memory/4648-1598-0x0000000005F00000-0x0000000005F24000-memory.dmp
        Download

        memory/4648-1563-0x00000000032C0000-0x00000000033A1000-memory.dmp
        Download

        memory/4648-1702-0x00000000033B0000-0x00000000033D8000-memory.dmp
        Download

        memory/4648-1575-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/4764-1644-0x0000000004E60000-0x0000000004E84000-memory.dmp
        Download

        memory/4764-1640-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/4764-1633-0x0000000003270000-0x0000000003351000-memory.dmp
        Download

        memory/4764-1672-0x0000000003090000-0x00000000030B8000-memory.dmp
        Download

        memory/4912-0-0x0000000000400000-0x0000000000566000-memory.dmp
        Download

        memory/5044-1650-0x0000000003900000-0x0000000003928000-memory.dmp
        Download

        memory/5044-1395-0x0000000036320000-0x0000000036330000-memory.dmp
        Download

        memory/5044-1388-0x0000000003390000-0x0000000003471000-memory.dmp
        Download

        memory/5044-1384-0x000000006DEA0000-0x000000006DEB0000-memory.dmp
        Download

        memory/5204-1657-0x0000000002B50000-0x0000000002D24000-memory.dmp
        Download