procexp64[.]exe | Triage™

Resubmissions

13/08/2026, 19:51

260813-ykvkzawybv

13/08/2026, 18:37

260813-w9tc4aej218

Sharing

Copy URL Twitter E-mail

General

Target
procexp64.exe
Size 2.3MB
Sample260813-w9tc4aej21
SHA256 d2c9351b60208915647b56e902bcecd87b9694b5b406e09500396f64f826b5ff
MD5 da09e3a798cbb7e73e413208facaa718
SHA1 b8ed925c70b04aa86f0ea239b441ec78b666b68a
SHA512 9c000436f8aaa7ebaf81c1fbc4831809c5c7affcf53f87c6a6bfc5a9b1b3ab82432a0cb035f3165775b992720697a966132dc1cfbce25e03a0ee7963d7872ca8
SSDEEP 24576:5zpebCKGIvEKLlHhseCUB2YhfSkvFmofbulTIYy2vbZ/Ey7OAgPI:5zAbPhv/lHbP9SQnf6lUYfvbU/A
TLSH
T1A5B59F4393EC41E5E07B9734896A8226FEF27C150B7496DF0245FA1E1F33AC25A76722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

procexp64.exe

.exe 2.3MB

procexp64.exe

IMPHASH 994b14da736c8f6cdcca49337922ee88
SHA256 d2c9351b60208915647b56e902bcecd87b9694b5b406e09500396f64f826b5ff
MD5 da09e3a798cbb7e73e413208facaa718
SHA1 b8ed925c70b04aa86f0ea239b441ec78b666b68a
SHA512 9c000436f8aaa7ebaf81c1fbc4831809c5c7affcf53f87c6a6bfc5a9b1b3ab82432a0cb035f3165775b992720697a966132dc1cfbce25e03a0ee7963d7872ca8
SSDEEP 24576:5zpebCKGIvEKLlHhseCUB2YhfSkvFmofbulTIYy2vbZ/Ey7OAgPI:5zAbPhv/lHbP9SQnf6lUYfvbU/A
TLSH
T1A5B59F4393EC41E5E07B9734896A8226FEF27C150B7496DF0245FA1E1F33AC25A76722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

b0:88:9c:48:d0:d4:06:69:b4:15:4a:9d:8f:e0:35:70:81:69:af:4b:a4:65:f5:91:a0:e7:bd:3b:0d:1d:6c:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 20, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

941328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\__w\1\s\exe\x64\Release\procexp64.pdb

shlwapi

ColorRGBToHLS ColorHLSToRGB SHAutoComplete StrCmpIW PathIsNetworkPathW UrlUnescapeW StrStrIW ord176

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable

ws2_32

htons htonl ntohl WSAStartup getservbyport gethostbyaddr ntohs

mpr

WNetGetConnectionW

comctl32

ImageList_ReplaceIcon ImageList_Add InitCommonControlsEx ImageList_Destroy ImageList_DrawEx ImageList_GetIconSize ImageList_Create ImageList_AddMasked ImageList_BeginDrag ImageList_EndDrag ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ord17 PropertySheetW CreateStatusWindowW CreatePropertySheetPageW ImageList_GetIcon ord410 ord413

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

credui

CredUIPromptForCredentialsW

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces

crypt32

CertDuplicateCertificateContext CertGetNameStringW

aclui

ord1

powrprof

IsPwrSuspendAllowed SetSuspendState IsPwrHibernateAllowed

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSSendMessageW WTSLogoffSession WTSFreeMemory WTSDisconnectSession

uxtheme

CloseThemeData OpenThemeData EnableThemeDialogTexture SetWindowTheme GetThemePartSize DrawThemeBackground

ntdll

NtQuerySymbolicLinkObject NtQueryObject NtOpenSymbolicLinkObject NtQuerySystemInformation NtSetInformationProcess VerSetConditionMask NtLoadDriver NtQuerySemaphore NtOpenKey NtQueryInformationThread NtQuerySection NtSuspendThread NtResumeThread NtResumeProcess NtOpenThread RtlCreateQueryDebugBuffer RtlQueryProcessDebugInformation RtlDestroyQueryDebugBuffer NtQueryEvent NtQueryMutant NtCreateKey RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtQueryInformationProcess NtSuspendProcess RtlUnwind

gdi32

CreateRectRgnIndirect CreateSolidBrush DeleteDC GetBkColor GetBkMode GetDeviceCaps CreateDIBSection LineTo RectInRegion SelectClipRgn SelectObject SetBkColor SetDCPenColor SetBkMode SetTextColor GetTextMetricsW MoveToEx Polyline ExtTextOutW SetViewportOrgEx CreateCompatibleDC GetTextExtentPoint32W Rectangle SetTextAlign TextOutW SetMapMode StartDocW EndDoc StartPage EndPage CreateBitmap CreatePatternBrush ExcludeClipRect GetCurrentObject PatBlt Polygon GetTextExtentExPointW RestoreDC SaveDC SetROP2 CreatePen CreateCompatibleBitmap BitBlt DeleteObject CreateFontIndirectW GetObjectW GetStockObject

comdlg32

ChooseColorW GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError ChooseFontW PrintDlgW FindTextW

kernel32

CreateFileW FileTimeToLocalFileTime GetFileSize GetFileTime GetFullPathNameW GetLongPathNameW WriteFile CloseHandle GetLastError SetErrorMode InitializeCriticalSection Sleep GetCurrentProcess ExitThread TlsAlloc TlsSetValue CreateProcessW OpenProcess GetVersion GetSystemWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile IsWow64Process GetSystemWow64DirectoryW GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree FormatMessageA lstrlenW FileTimeToSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW GetNumberFormatW LCMapStringW Process32FirstW Process32NextW FindFirstFileW GetFileAttributesW GetPrivateProfileStringW FreeLibrary LoadLibraryExW ReadFile MultiByteToWideChar FindClose FindNextFileW EnterCriticalSection LeaveCriticalSection SetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects GetCurrentThread HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap CreateThread GetExitCodeThread FindResourceExW LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW GetVersionExW GetFileSizeEx LoadLibraryW GetTickCount MulDiv GlobalAddAtomW GlobalAlloc GlobalUnlock GlobalLock GetPrivateProfileIntW RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetCurrentThreadId DeleteFileW GetTempFileNameW GetTempPathW GetThreadId FormatMessageW GetCommandLineW GetFileType LocalAlloc TerminateThread GlobalReAlloc Module32FirstW Module32NextW GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime IsBadStringPtrW OpenEventW VerifyVersionInfoW GetEnvironmentVariableW ReadProcessMemory lstrcmpiW GetSystemDirectoryW SearchPathW SetFilePointer GetCurrentProcessId VirtualQueryEx OpenThread SuspendThread ResumeThread GetThreadContext Thread32First Thread32Next QueryPerformanceCounter QueryPerformanceFrequency ResetEvent IsBadReadPtr TerminateProcess SetPriorityClass ProcessIdToSessionId GetProcessId GlobalMemoryStatusEx GetLogicalProcessorInformation SetProcessWorkingSetSize GlobalFree PulseEvent GetComputerNameW WTSGetActiveConsoleSessionId GetCurrentDirectoryW GetDriveTypeW OutputDebugStringW DuplicateHandle DeviceIoControl GetProcessInformation VirtualAlloc VirtualFree GetProcessWorkingSetSize TrySubmitThreadpoolCallback IsProcessInJob CreateJobObjectW QueryInformationJobObject GetThreadGroupAffinity SetThreadGroupAffinity GlobalMemoryStatus GetProcessAffinityMask SetProcessAffinityMask GetActiveProcessorGroupCount GetActiveProcessorCount WideCharToMultiByte K32GetModuleFileNameExW K32GetMappedFileNameW K32QueryWorkingSet IsDebuggerPresent GetStartupInfoW GetThreadIdealProcessorEx GetTickCount64 QueryThreadCycleTime SystemTimeToTzSpecificLocalTime GetNativeSystemInfo IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetConsoleMode ReadConsoleInputW GetStdHandle ReadConsoleW GetTimeZoneInformation TlsGetValue FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount TlsFree FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetConsoleCP GetSystemInfo VirtualProtect VirtualQuery FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringEx GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetEndOfFile WriteConsoleW GetStringTypeW TryAcquireSRWLockExclusive ExpandEnvironmentStringsW SetLastError CompareStringW AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer CreateToolhelp32Snapshot DecodePointer

user32

GetMenuItemInfoW SetMenuDefaultItem AllowSetForegroundWindow AdjustWindowRectEx MessageBeep SetCursorPos ClientToScreen WindowFromPoint SetRectEmpty GetDesktopWindow GetWindow CheckMenuRadioItem MonitorFromPoint GetWindowPlacement CheckDlgButton IsDlgButtonChecked EnableWindow ModifyMenuW TrackPopupMenu SetMenuInfo InvalidateRgn SetClassLongW EnumWindows CopyAcceleratorTableW TranslateAcceleratorW DrawMenuBar IsDialogMessageW GetMenuBarInfo ShowWindowAsync IsIconic EndTask RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW ExitWindowsEx SetLayeredWindowAttributes CreateDialogParamW GetDlgItemTextW CreateMenu GetMenuInfo EndMenu LoadIconW LockWorkStation ChangeWindowMessageFilterEx IsHungAppWindow SendMessageTimeoutW SetDlgItemInt CheckRadioButton MsgWaitForMultipleObjects GetGuiResources CharNextW MoveWindow IsChild GetSysColorBrush GetWindowTextLengthW GetWindowTextW SetWindowTextW KillTimer GetClassInfoExW UnregisterClassW DrawIconEx RemoveMenu SetMenuItemInfoW DestroyMenu EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetScrollInfo SetScrollInfo GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW OffsetRect IntersectRect InflateRect CopyRect SetRect FillRect MapWindowPoints GetCursorPos GetWindowRect GetClientRect GetPropW SetPropW ScrollWindowEx ValidateRect InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW SetTimer ReleaseCapture SetCapture GetCapture GetKeyState GetFocus SetWindowPos CreateWindowExW RegisterClassExW CallWindowProcW DefWindowProcW GetParent SetDlgItemTextW PostMessageW LoadStringW ReleaseDC GetDC EnumDisplaySettingsW LoadImageW DestroyIcon LoadCursorW GetWindowThreadProcessId FindWindowExW FindWindowW SetCursor MessageBoxW SetForegroundWindow DeleteMenu InsertMenuW GetSubMenu CheckMenuItem GetMenu GetSystemMetrics SetFocus ShowWindow WaitForInputIdle SendMessageW AppendMenuW GetMenuItemCount GetMenuItemID EnableMenuItem CreatePopupMenu GetMenuStringW LoadMenuW LoadAcceleratorsW GetDlgCtrlID SetWindowPlacement IsWindow PostQuitMessage GetMessagePos PeekMessageW DrawEdge TrackMouseEvent LoadStringA DefMDIChildProcW DefFrameProcW DefDlgProcW CreateIconIndirect DestroyWindow EnumChildWindows UnionRect EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DrawFrameControl DialogBoxParamW GetDlgItem EndDialog DialogBoxIndirectParamW GetAncestor GetWindowModuleFileNameW GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW SetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect FrameRect DrawFocusRect ScreenToClient TrackPopupMenuEx ShowScrollBar SetScrollPos RedrawWindow GetWindowDC IsWindowEnabled IsZoomed GetSysColor IsWindowVisible

advapi32

AllocateAndInitializeSid DuplicateTokenEx EqualSid FreeSid GetTokenInformation ImpersonateLoggedOnUser RevertToSelf LookupAccountSidW LookupAccountNameW LookupPrivilegeValueW RegCreateKeyExW RegDeleteKeyW RegEnumKeyW RegEnumValueW RegLoadKeyW RegOpenKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegUnLoadKeyW RegQueryValueW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData AdjustTokenPrivileges RegDeleteValueW CloseServiceHandle GetServiceDisplayNameW OpenSCManagerW OpenServiceW QueryServiceConfig2W ControlService QueryServiceStatus StartServiceW RegCreateKeyW RegGetValueW MapGenericMask QueryServiceObjectSecurity SetServiceObjectSecurity StartTraceW ControlTraceW OpenTraceW ProcessTrace CloseTrace CopySid GetLengthSid QueryServiceConfigW AddAccessAllowedAce AddAce CreateRestrictedToken GetAce GetSidIdentifierAuthority GetSidSubAuthority GetSidSubAuthorityCount InitializeAcl CryptDestroyHash RegCloseKey IsValidSid SetTokenInformation GetSecurityInfo SetSecurityInfo LsaFreeMemory RegEnumKeyExW LsaClose LsaOpenPolicy LsaEnumerateAccountRights ConvertSidToStringSidW FlushTraceW RegConnectRegistryW CreateProcessAsUserW GetKernelObjectSecurity SetKernelObjectSecurity LookupPrivilegeNameW EnumServicesStatusExW OpenProcessToken

shell32

SHGetFolderPathW SHGetFileInfoW ShellExecuteW SHGetStockIconInfo SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc Shell_NotifyIconW ShellExecuteExW ExtractAssociatedIconW ExtractIconExW

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoMarshalInterThreadInterfaceInStream CoInitializeEx CoSetProxyBlanket CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoGetInterfaceAndReleaseStream

oleaut32

SysFreeString SysAllocString SysStringLen VarUI4FromStr SysAllocStringLen SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayDestroy VariantChangeType VariantClear VariantInit SysAllocStringByteLen

msimg32

GradientFill

dwmapi

DwmDefWindowProc DwmSetWindowAttribute

winhttp

WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl WinHttpWriteData WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpenRequest WinHttpSendRequest WinHttpQueryDataAvailable