Overview

overview

7

Static

static

3

2026-08-03...er.exe

windows10-2004-x64

7

2026-08-03...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 08:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_f807dc419cc1de6e30491ec25bef4c17_amadey_elex_smoke-loader.exe
  • Size 60.2MB
  • Sample260804-ktbbsswcnf
  • SHA256 8f4dcc989999fa7e64e6eba37302489f6cc50aff9d4ac8ebcba8c56c14ca939d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes to the Master Boot Record (MBR) 1 TTPs 14 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_f807dc419cc1de6e30491ec25bef4c17_amadey_elex_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_f807dc419cc1de6e30491ec25bef4c17_amadey_elex_smoke-loader.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c set
      2⤵
      • Executes a command shell one-liner
      PID:4148
    • C:\Users\Admin\AppData\Local\Temp\~1434515152239647774~\sg.tmp
      7zG_exe x "C:\Users\Admin\AppData\Local\Temp\2026-08-03_f807dc419cc1de6e30491ec25bef4c17_amadey_elex_smoke-loader.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~2027503279982857074"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3120
    • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
      "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --type=utility --field-trial-handle=3132,2402778062565176840,706987743620225085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --no-sandbox --mojo-platform-channel-handle=3148 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:408
      • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3132,2402778062565176840,706987743620225085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app" --node-integration --webview-tag --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app/out/common-preload.js" --enable-remote-module --background-color=#FFF --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3256 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3452
        • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/plugins/VipPluginController/config.json --xdas-plugin-name=VipPluginController
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5840
        • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/plugins/VipDownload/config.json --xdas-plugin-name=VipDownload
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:704
        • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/plugins/User/config.json --xdas-plugin-name=User
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5468
        • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\bin\SDK\DownloadSDKServer.exe
          "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\bin\SDK\DownloadSDKServer.exe" BDAF7A63-568C-43ab-9406-D145CF03B08C:3452
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:1748
        • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/plugins/ThunderPanPlugin/config.json --xdas-plugin-name=ThunderPanPlugin
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          PID:5836
        • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
          C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/out/plugin-boot.js --type=xdas-plugin-process --xdas-plugin-config=C:/Users/Admin/AppData/Local/Temp/~2027503279982857074/Program/resources/app/plugins/XmpPlugin/config.json --xdas-plugin-name=XmpPlugin
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          PID:6056
        • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\plugins\XmpPlugin\0.0.7\bin\APlayer.exe
          "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\plugins\XmpPlugin\0.0.7\bin\APlayer.exe" --server-id="XmplitePlayer" --client-id="XmpPlayerAplayer" --process-id=3452
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          PID:720
        • C:\Windows\SysWOW64\ping.exe
          C:\Windows/system32/ping.exe -w 5000 -n 1 hub5u.sandai.net
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5248
        • C:\Windows\SysWOW64\ping.exe
          C:\Windows/system32/ping.exe -w 5000 -n 1 hub5pn.sandai.net
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5564
      • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3132,2402778062565176840,706987743620225085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\plugin-boot.js" --enable-remote-module --background-color=#fff --guest-instance-id=2 --enable-blink-features --disable-blink-features --enable-spellcheck --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3472 /prefetch:1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4328
      • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3132,2402778062565176840,706987743620225085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\plugin-boot.js" --enable-remote-module --background-color=#fff --guest-instance-id=2 --enable-blink-features --disable-blink-features --enable-spellcheck --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4132 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4596
      • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3132,2402778062565176840,706987743620225085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app/out/common-preload.js" --enable-remote-module --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4180 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:1344
      • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3132,2402778062565176840,706987743620225085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\plugin-boot.js" --enable-remote-module --background-color=#fff --guest-instance-id=4 --enable-blink-features --disable-blink-features --enable-spellcheck --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4256 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:5792
      • C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
        "C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --type=renderer --no-sandbox --field-trial-handle=3132,2402778062565176840,706987743620225085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe" --app-path="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app" --node-integration --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\plugin-boot.js" --enable-remote-module --background-color=#fff --guest-instance-id=4 --enable-blink-features --disable-blink-features --enable-spellcheck --enable-websql --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4260 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:1116

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        pub_store.dat
        • Path C:\ProgramData\Thunder Network\DownloadLib\pub_store.dat
        • Size 133B
        • SHA256 64ff85ef0938bd1c7de91b74dc555cb15afd1f90d161789838ab3f9a667deff6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        crashinfo.ini
        • Path C:\Users\Admin\AppData\Local\Temp\Thunder Network\xl11\crashinfo.ini
        • Size 34B
        • SHA256 7753160583a4678875d07b9078463f5da8f331b7dc9159dfce5d04123ccf68d9
        • MD5 SHA1 SHA512
        Submit Download

        sg.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~1434515152239647774~\sg.tmp
        • Size 715KB
        • SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Thunder.exe
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\Thunder.exe
        • Size 607KB
        • SHA256 0eec405c42213aa6bc5926d15c65041fd04bfe833bbdd3420cd5abc266ea6cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        XLBugHandler.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\XLBugHandler.dll
        • Size 574KB
        • SHA256 c7ef10c5fd6ab171ca801e76b178dc6ce9b881712f16ba81cdd15463886a4ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        detect_stat.dat
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\detect_stat.dat
        • Size 8B
        • SHA256 9bd4e7da69e147e60c9d5d9124a0c57ef34363668a3b97e42c618d0756eafb7e
        • MD5 SHA1 SHA512
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\ffmpeg.dll
        • Size 2.5MB
        • SHA256 61f328957e35103d2177eb90f3c17d1af1017883bf73592e7165ff996135e3a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\icudtl.dat
        • Size 10.0MB
        • SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        latest_thunder_stat.xml
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\latest_thunder_stat.xml
        • Size 1KB
        • SHA256 4c92e2ca3ff29886143a0138bb5e211810cb2fe926f29d7ade2bda93f29f0a63
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libexpat.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\libexpat.dll
        • Size 409KB
        • SHA256 181903fb256b663789c4056912061f90bf8628b14cb83c9c8e2929bad64468b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\locales\en-US.pak
        • Size 76KB
        • SHA256 6d9baf2f803f792c09fc4764c134a479b98d7b4644c88789c1f4b086a9edb0c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        minizip.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\minizip.dll
        • Size 144KB
        • SHA256 788467a9c7d8f54aed0630c349eb84329ea2d228cfa110b35c6d86beb87579be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources.pak
        • Size 4.3MB
        • SHA256 4ecce7518fdc0435a8cdfd3c64face116a10bfcde0a8e9b3f1ae31ef515f948c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        common-preload.js
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\common-preload.js
        • Size 3KB
        • SHA256 aaa333a6daec927634bbd1baf4224b01ff10e0c02c6d9b615360bba55c2bd1b3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        common-style.css
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\common-style.css
        • Size 52KB
        • SHA256 9fa0778158395cd2aad040ed4c04447f9a27b60ac419625503c753e69172f7a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.html
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\main-renderer\index.html
        • Size 3KB
        • SHA256 e25957459af9ecd100d83fe1769ef1a32f4a833e532f6592804efe7a953d67ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        renderer.css
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\main-renderer\renderer.css
        • Size 1.0MB
        • SHA256 f4e1126805cdb5594be85b8d8aa13efb18620af26a1652b54895d28a2a9cedec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.js
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\main.js
        • Size 354KB
        • SHA256 28e2e8b7e49bdaf67553d40d62d4580324809d45b0fb30291585e13946f6df80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        renderer.css
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\pre-new-task-renderer\renderer.css
        • Size 222KB
        • SHA256 14f7f890320e9fbd9870f6a0a351f2b8b26515a8842aabec81f272d95e08822c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        renderer.css
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\search-renderer\renderer.css
        • Size 206KB
        • SHA256 afcb79e2bd98de2dcccb0e3376ecc5c62c0a7d99955232cb3b157e3ab99e1676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        skeleton.js
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\skeleton.js
        • Size 5KB
        • SHA256 a9c20e1fd485d35ff592eca076be37643ccfa9851e4ea666fec26938baea79cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vendor.js
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\out\vendor.js
        • Size 259KB
        • SHA256 380d57b2261009d0e86923498e112ef0f89a4c66cc5d1ca10ec48889078f28e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package.json
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\package.json
        • Size 124B
        • SHA256 b15714ad1ace355c9aaa770916f2bca6848e4d3bd7520284c6c415f3a64162ce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        spr-browser.87d9c5e.png
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\plugins\ThunderXWebXDAS\versions\4.8.4\_nuxt\img\spr-browser.87d9c5e.png
        • Size 1KB
        • SHA256 3ebc93bdfa32b599d07a965d0cfef672a31094b1956146be88b1f5e14eface19
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        icon-vip.png
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\plugins\VipDownload\4.5.2\static\img\icon-vip.png
        • Size 2KB
        • SHA256 de27b206929e520d72dadc0017f044e9ba68ac584f88daeea3c51aa426f49e18
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bg-music.png
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\plugins\XmpPlugin\0.0.7\imgs\bg-music.png
        • Size 162KB
        • SHA256 f18d61cdc92a3c22b205759fdd41f30b0f22e40dbfdfca46340c0152f3c59cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        renderer.css
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\app\plugins\XmpPlugin\0.0.7\message-box-renderer\renderer.css
        • Size 74KB
        • SHA256 65e2201996f773b4a2003f367b16ae2504b58a0fb58bd686ec9a155dd22488bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ThunderHelper.node
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\bin\ThunderHelper.node
        • Size 999KB
        • SHA256 d8f8ef764bdd7861e34595ba31e26eb01d321f0fcabaebcaace82d066a0080ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ThunderNewTask.node
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\resources\bin\ThunderNewTask.node
        • Size 143KB
        • SHA256 cdc05b4372ed60f4370cfef9d407688a859471501eaa1526d99c4c543781cdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stat.dat
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\stat.dat
        • Size 917B
        • SHA256 f92f664de28ef222c78e1a440ecd6c85274256be409dd0598b5e73fd194f6d37
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\v8_context_snapshot.bin
        • Size 166KB
        • SHA256 87b1ea557a0c92272e8b52d9bae44769164717e57a649c67b0ed80f17998faff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xlstat4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\xlstat4.dll
        • Size 567KB
        • SHA256 07d5251432c2192a911f103802a0aeb22f6eaf8bc16c844772c168b3cf28af62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\Program\zlib1.dll
        • Size 431KB
        • SHA256 18618480bc15ffbf1c4a19e1b90050f65a5de04e611d34d9c882df45a78e6bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mainWndData.ini
        • Path C:\Users\Admin\AppData\Local\Temp\~2027503279982857074\profiles\mainWndData.ini
        • Size 93B
        • SHA256 6fe2055b47ae5f3aad7c11b5fbb647f7db427fbf69e92f5e09a43936b6e63447
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        4303fa02-ab59-4779-8df6-26162433c23d.tmp
        • Path C:\Users\Admin\AppData\Roaming\thunder\4303fa02-ab59-4779-8df6-26162433c23d.tmp
        • Size 590B
        • SHA256 75250f0dce0307ad621d354a4e0a435c95289c42afbad69c91049efbe1f101f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        en-US-9-0.bdic
        • Path C:\Users\Admin\AppData\Roaming\thunder\Dictionaries\en-US-9-0.bdic
        • Size 441KB
        • SHA256 0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Network Persistent State~RFe5a27bd.TMP
        • Path C:\Users\Admin\AppData\Roaming\thunder\Network Persistent State~RFe5a27bd.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Roaming\thunder\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        GlobalSetting.ini
        • Path C:\Users\Public\Thunder Network\DownloadSDK\Profiles\pc.thunderX\GlobalSetting.ini
        • Size 404B
        • SHA256 d0ddb632121957ee91c8e373841056a752ca51fcdd258341f2b76bce356f1c71
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GlobalSetting.ini
        • Path C:\Users\Public\Thunder Network\DownloadSDK\Profiles\pc.thunderX\GlobalSetting.ini
        • Size 563B
        • SHA256 a65786a95a0cea9274a5143a9b855dc47ba44ec1b26bf5e417f285ed5115d9d6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/408-1439-0x0000000002BB0000-0x0000000002C91000-memory.dmp
        Download

        memory/408-1449-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/704-1529-0x000000000B250000-0x000000000B274000-memory.dmp
        Download

        memory/704-1508-0x00000000032E0000-0x00000000033C1000-memory.dmp
        Download

        memory/704-1518-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/720-1666-0x0000000003620000-0x00000000037F4000-memory.dmp
        Download

        memory/1116-1616-0x000000000C000000-0x000000000C024000-memory.dmp
        Download

        memory/1116-1609-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/1116-1602-0x0000000003360000-0x0000000003441000-memory.dmp
        Download

        memory/1344-1575-0x0000000002220000-0x0000000002301000-memory.dmp
        Download

        memory/1344-1595-0x000000000B440000-0x000000000B464000-memory.dmp
        Download

        memory/1344-1584-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/1748-1537-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/2568-1385-0x000000006ED50000-0x000000006ED60000-memory.dmp
        Download

        memory/2568-1389-0x00000000035D0000-0x00000000036B1000-memory.dmp
        Download

        memory/2568-1396-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/2568-1421-0x000000000DD10000-0x000000000DD34000-memory.dmp
        Download

        memory/3452-1461-0x0000000002B50000-0x0000000002C31000-memory.dmp
        Download

        memory/3452-1483-0x000000000B8C0000-0x000000000B8E4000-memory.dmp
        Download

        memory/3452-1470-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/3716-0-0x0000000000400000-0x0000000000566000-memory.dmp
        Download

        memory/4328-1557-0x00000000027B0000-0x0000000002891000-memory.dmp
        Download

        memory/4596-1567-0x000000000BAA0000-0x000000000BAC4000-memory.dmp
        Download

        memory/4596-1553-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/4596-1547-0x0000000002DD0000-0x0000000002EB1000-memory.dmp
        Download

        memory/5468-1527-0x000000000AFA0000-0x000000000AFC4000-memory.dmp
        Download

        memory/5468-1524-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/5468-1511-0x00000000030B0000-0x0000000003191000-memory.dmp
        Download

        memory/5792-1615-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/5792-1599-0x00000000032C0000-0x00000000033A1000-memory.dmp
        Download

        memory/5836-1593-0x000000000B210000-0x000000000B234000-memory.dmp
        Download

        memory/5836-1573-0x0000000003390000-0x0000000003471000-memory.dmp
        Download

        memory/5836-1589-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/5840-1495-0x0000000003290000-0x0000000003371000-memory.dmp
        Download

        memory/5840-1525-0x000000000B000000-0x000000000B024000-memory.dmp
        Download

        memory/5840-1506-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/6056-1627-0x0000000037530000-0x0000000037540000-memory.dmp
        Download

        memory/6056-1642-0x000000000A640000-0x000000000A664000-memory.dmp
        Download