184280a3b257a1e16cfcddc66716e1ad9f055c8876cf64a293cd49a11bd745ff

Analysis

user interaction
yes
max time kernel
10s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 03:58

Target
ThunderPaidMapper.exe
Size 149KB
Sample261014-ejf7eavy2r
SHA256 184280a3b257a1e16cfcddc66716e1ad9f055c8876cf64a293cd49a11bd745ff
MD5 9e2b91d47f14e1947302b64ebd37a851
SHA1 a11df49a586814508e550fbc366d54a71998fa08
SHA512 e26ee32443e45bffdd57c073076ede12e02cb800709d67f026e57b062b0f7e3ebd29ed6009a1f3d6b4bb45e34dc445dde20a579f6ae1ab8f3b91d6d1a9da6bc6
SSDEEP 3072:1Q1ppgDBliyBykDS50QaKmbkwMmJTQSaMm5/6yRSTKsXhY:ehABliyHS5V7moAWlFcTKs6
TLSH
T1F5E31A1797A5102DE1B7DAB8CEB24911EB727C550B74D2CF135049BA0E62BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4476	ThunderPaidMapper.exe
4476	ThunderPaidMapper.exe

C:\Users\Admin\AppData\Local\Temp\ThunderPaidMapper.exe
"C:\Users\Admin\AppData\Local\Temp\ThunderPaidMapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476