procexp64[.]exe | Triage™

Resubmissions

28/09/2026, 15:49

260928-s9gshsx19q8

28/09/2026, 15:47

260928-s8dpgaxerc8

28/09/2026, 15:44

260928-s6wr9sytax8

Sharing

Copy URL Twitter E-mail

General

Target
procexp64.exe
Size 2.3MB
Sample260928-s8dpgaxerc
SHA256 917b5d71f732bf5b5423cd212c004b2433a63e9dfe02a2a27ea421252c815690
MD5 033caf38febdb440154860fb1a27bb3e
SHA1 1b028ab41da859c2adfc9c6bc8eedf18df86a76e
SHA512 a90560a30d7aacb53211e7388b84f467ac3b325414532486968e6b2b7b29e924d275438c114314618c1a78a2750c5040a363882a4da6de37cfc876920c0dacef
SSDEEP 24576:FtnOrYN933Qy7ajl0ZP4g4tmmc1gsOYUWPqVRG4WgFDi7N3n+Fm0XfS:FVOr633HajS9ac1nlUWPug4WCDi75U6
TLSH
T1F8B59F5393EC41E5E07B9734896A4626FEF27C150B3496DF0245FA1E2F33AC24A76722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

procexp64.exe

.exe 2.3MB

procexp64.exe

IMPHASH 66ac70f4a40103a733a0cf9869ad2cc2
SHA256 917b5d71f732bf5b5423cd212c004b2433a63e9dfe02a2a27ea421252c815690
MD5 033caf38febdb440154860fb1a27bb3e
SHA1 1b028ab41da859c2adfc9c6bc8eedf18df86a76e
SHA512 a90560a30d7aacb53211e7388b84f467ac3b325414532486968e6b2b7b29e924d275438c114314618c1a78a2750c5040a363882a4da6de37cfc876920c0dacef
SSDEEP 24576:FtnOrYN933Qy7ajl0ZP4g4tmmc1gsOYUWPqVRG4WgFDi7N3n+Fm0XfS:FVOr633HajS9ac1nlUWPug4WCDi75U6
TLSH
T1F8B59F5393EC41E5E07B9734896A4626FEF27C150B3496DF0245FA1E2F33AC24A76722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Password

lmao

Digest

2d:0e:67:fe:0a:ec:2d:87:4b:2d:e8:0f:68:16:73:9e:1d:4c:2b:fd:56:02:b0:b2:2e:41:e8:3b:c0:28:23:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 12, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

946912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\__w\1\s\exe\x64\Release\procexp64.pdb

shlwapi

ColorRGBToHLS ColorHLSToRGB SHAutoComplete StrCmpIW PathIsNetworkPathW UrlUnescapeW StrStrIW ord176

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable

ws2_32

htons htonl ntohl WSAStartup getservbyport gethostbyaddr ntohs

mpr

WNetGetConnectionW

comctl32

ImageList_ReplaceIcon ImageList_Add InitCommonControlsEx ImageList_Destroy ImageList_DrawEx ImageList_GetIconSize ImageList_Create ImageList_AddMasked ImageList_BeginDrag ImageList_EndDrag ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ord17 PropertySheetW CreateStatusWindowW CreatePropertySheetPageW ImageList_GetIcon ord410 ord413

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

credui

CredUIPromptForCredentialsW

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces

crypt32

CertDuplicateCertificateContext CertGetNameStringW

aclui

ord1

powrprof

IsPwrSuspendAllowed SetSuspendState IsPwrHibernateAllowed

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSSendMessageW WTSLogoffSession WTSFreeMemory WTSDisconnectSession

uxtheme

CloseThemeData OpenThemeData EnableThemeDialogTexture SetWindowTheme GetThemePartSize DrawThemeBackground

ntdll

NtQueryObject NtOpenSymbolicLinkObject NtQuerySystemInformation NtSetInformationProcess NtQueryInformationProcess VerSetConditionMask NtUnloadDriver NtLoadDriver NtQuerySymbolicLinkObject NtOpenKey NtQueryInformationThread NtQuerySection NtSuspendThread NtResumeThread NtResumeProcess NtOpenThread RtlCreateQueryDebugBuffer RtlQueryProcessDebugInformation RtlDestroyQueryDebugBuffer NtQuerySemaphore NtQueryEvent NtCreateKey RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtQueryMutant NtSuspendProcess RtlUnwind

gdi32

CreateRectRgnIndirect CreateSolidBrush DeleteDC GetBkColor GetBkMode GetDeviceCaps CreateDIBSection LineTo RectInRegion SelectClipRgn SelectObject SetBkColor SetDCPenColor SetBkMode SetTextColor GetTextMetricsW MoveToEx Polyline ExtTextOutW SetViewportOrgEx CreateCompatibleDC GetTextExtentPoint32W Rectangle SetTextAlign TextOutW SetMapMode StartDocW EndDoc StartPage EndPage CreateBitmap CreatePatternBrush ExcludeClipRect GetCurrentObject PatBlt Polygon GetTextExtentExPointW RestoreDC SaveDC SetROP2 CreatePen CreateCompatibleBitmap BitBlt DeleteObject CreateFontIndirectW GetObjectW GetStockObject

comdlg32

ChooseColorW GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError ChooseFontW PrintDlgW FindTextW

kernel32

CreateFileW FileTimeToLocalFileTime GetFileSize GetFileTime GetFullPathNameW GetLongPathNameW WriteFile CloseHandle GetLastError SetErrorMode InitializeCriticalSection Sleep GetCurrentProcess ExitThread TlsAlloc TlsSetValue CreateProcessW OpenProcess GetVersion GetSystemWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile IsWow64Process GetSystemWow64DirectoryW GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree FormatMessageA lstrlenW FileTimeToSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW GetNumberFormatW LCMapStringW Process32FirstW Process32NextW FindFirstFileW GetFileAttributesW GetPrivateProfileStringW FreeLibrary LoadLibraryExW ReadFile MultiByteToWideChar FindClose FindNextFileW EnterCriticalSection LeaveCriticalSection SetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects GetCurrentThread HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap CreateThread GetExitCodeThread FindResourceExW LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW GetVersionExW GetFileSizeEx LoadLibraryW GetTickCount MulDiv GlobalAddAtomW GlobalAlloc GlobalUnlock GlobalLock GetPrivateProfileIntW RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetCurrentThreadId DeleteFileW GetTempFileNameW GetTempPathW GetThreadId FormatMessageW GetCommandLineW GetFileType LocalAlloc TerminateThread GlobalReAlloc Module32FirstW Module32NextW GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime IsBadStringPtrW OpenEventW VerifyVersionInfoW GetEnvironmentVariableW ReadProcessMemory lstrcmpiW GetSystemDirectoryW SearchPathW SetFilePointer GetCurrentProcessId VirtualQueryEx QueryFullProcessImageNameW OpenThread SuspendThread ResumeThread GetThreadContext Thread32First Thread32Next QueryPerformanceCounter QueryPerformanceFrequency ResetEvent IsBadReadPtr TerminateProcess SetPriorityClass ProcessIdToSessionId GetProcessId GlobalMemoryStatusEx GetLogicalProcessorInformation SetProcessWorkingSetSize GlobalFree PulseEvent GetComputerNameW WTSGetActiveConsoleSessionId GetCurrentDirectoryW GetDriveTypeW OutputDebugStringW DuplicateHandle DeviceIoControl GetProcessInformation VirtualAlloc VirtualFree GetProcessWorkingSetSize TrySubmitThreadpoolCallback IsProcessInJob CreateJobObjectW QueryInformationJobObject GetThreadGroupAffinity SetThreadGroupAffinity GlobalMemoryStatus GetProcessAffinityMask SetProcessAffinityMask GetActiveProcessorGroupCount GetActiveProcessorCount WideCharToMultiByte K32GetModuleFileNameExW K32GetMappedFileNameW K32QueryWorkingSet IsDebuggerPresent GetStartupInfoW GetThreadIdealProcessorEx GetTickCount64 QueryThreadCycleTime SystemTimeToTzSpecificLocalTime GetNativeSystemInfo IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetConsoleMode ReadConsoleInputW GetStdHandle ReadConsoleW GetTimeZoneInformation TlsGetValue FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount TlsFree FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetConsoleCP GetSystemInfo VirtualProtect VirtualQuery FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringEx GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetEndOfFile WriteConsoleW GetStringTypeW TryAcquireSRWLockExclusive ExpandEnvironmentStringsW SetLastError CompareStringW AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer CreateToolhelp32Snapshot DecodePointer

user32

GetMenuItemInfoW SetMenuDefaultItem AllowSetForegroundWindow AdjustWindowRectEx MessageBeep SetCursorPos ClientToScreen WindowFromPoint SetRectEmpty GetDesktopWindow GetWindow CheckMenuRadioItem MonitorFromPoint GetWindowPlacement CheckDlgButton IsDlgButtonChecked EnableWindow ModifyMenuW TrackPopupMenu SetMenuInfo InvalidateRgn SetClassLongW EnumWindows CopyAcceleratorTableW TranslateAcceleratorW DrawMenuBar IsDialogMessageW GetMenuBarInfo ShowWindowAsync IsIconic EndTask RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW ExitWindowsEx SetLayeredWindowAttributes CreateDialogParamW GetDlgItemTextW CreateMenu GetMenuInfo EndMenu LoadIconW LockWorkStation ChangeWindowMessageFilterEx IsHungAppWindow SendMessageTimeoutW SetDlgItemInt CheckRadioButton MsgWaitForMultipleObjects MapDialogRect GetGuiResources CharNextW MoveWindow IsChild GetSysColorBrush GetWindowTextLengthW GetWindowTextW SetWindowTextW KillTimer GetClassInfoExW UnregisterClassW RemoveMenu GetSysColor SetMenuItemInfoW DestroyMenu EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetScrollInfo SetScrollInfo GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW OffsetRect IntersectRect InflateRect CopyRect SetRect FillRect MapWindowPoints GetCursorPos GetWindowRect GetClientRect GetPropW SetPropW ScrollWindowEx ValidateRect InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW SetTimer ReleaseCapture SetCapture GetCapture GetKeyState GetFocus SetWindowPos CreateWindowExW RegisterClassExW CallWindowProcW DefWindowProcW GetParent SetDlgItemTextW PostMessageW LoadStringW ReleaseDC GetDC EnumDisplaySettingsW LoadImageW DestroyIcon LoadCursorW GetWindowThreadProcessId FindWindowExW FindWindowW SetCursor MessageBoxW SetForegroundWindow DeleteMenu InsertMenuW GetSubMenu CheckMenuItem GetMenu GetSystemMetrics SetFocus ShowWindow WaitForInputIdle SendMessageW AppendMenuW GetMenuItemCount GetMenuItemID EnableMenuItem CreatePopupMenu GetMenuStringW LoadMenuW LoadAcceleratorsW GetDlgCtrlID SetWindowPlacement IsWindow PostQuitMessage GetMessagePos PeekMessageW DrawEdge TrackMouseEvent LoadStringA DefMDIChildProcW DefFrameProcW DefDlgProcW CreateIconIndirect DestroyWindow EnumChildWindows UnionRect EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DrawFrameControl DialogBoxParamW GetDlgItem EndDialog DialogBoxIndirectParamW GetAncestor GetWindowModuleFileNameW GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW SetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect FrameRect DrawFocusRect ScreenToClient TrackPopupMenuEx ShowScrollBar SetScrollPos RedrawWindow GetWindowDC IsWindowEnabled IsZoomed DrawIconEx IsWindowVisible

advapi32

AllocateAndInitializeSid DuplicateTokenEx EqualSid FreeSid GetTokenInformation ImpersonateLoggedOnUser RevertToSelf LookupAccountSidW LookupAccountNameW LookupPrivilegeValueW RegCreateKeyExW RegDeleteKeyW RegEnumKeyW RegEnumValueW RegLoadKeyW RegOpenKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegUnLoadKeyW RegQueryValueW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData AdjustTokenPrivileges RegDeleteValueW CloseServiceHandle GetServiceDisplayNameW OpenSCManagerW OpenServiceW QueryServiceConfig2W ControlService QueryServiceStatus StartServiceW RegCreateKeyW RegGetValueW MapGenericMask QueryServiceObjectSecurity SetServiceObjectSecurity StartTraceW ControlTraceW OpenTraceW ProcessTrace CloseTrace CopySid GetLengthSid QueryServiceConfigW AddAccessAllowedAce AddAce CreateRestrictedToken GetAce GetSidIdentifierAuthority GetSidSubAuthority GetSidSubAuthorityCount InitializeAcl CryptDestroyHash RegCloseKey IsValidSid SetTokenInformation GetSecurityInfo SetSecurityInfo LsaFreeMemory RegEnumKeyExW LsaClose LsaOpenPolicy LsaEnumerateAccountRights ConvertSidToStringSidW FlushTraceW RegConnectRegistryW CreateProcessAsUserW GetKernelObjectSecurity SetKernelObjectSecurity LookupPrivilegeNameW EnumServicesStatusExW OpenProcessToken

shell32

SHGetFolderPathW SHGetFileInfoW ShellExecuteW SHGetStockIconInfo SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc Shell_NotifyIconW ShellExecuteExW ExtractAssociatedIconW ExtractIconExW

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoMarshalInterThreadInterfaceInStream CoInitializeEx CoSetProxyBlanket CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoGetInterfaceAndReleaseStream

oleaut32

SysFreeString SysAllocString SysStringLen VarUI4FromStr SysAllocStringLen SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayDestroy VariantChangeType VariantClear VariantInit SysAllocStringByteLen

msimg32

GradientFill

dwmapi

DwmDefWindowProc DwmSetWindowAttribute

winhttp

WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl WinHttpWriteData WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpenRequest WinHttpSendRequest WinHttpQueryDataAvailable

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

procexp64.exe

shlwapi

iphlpapi

ws2_32

mpr

comctl32

version

credui

setupapi

crypt32

aclui

powrprof

wtsapi32

uxtheme

ntdll

gdi32

comdlg32

kernel32

user32

advapi32

shell32

ole32

oleaut32

msimg32

dwmapi

winhttp

generic