File scan report
Verdict Safe
Is Easy
Only MaxSecure raised a generic detection among 75 engines, while major antivirus engines were silent and the completed sandbox run produced a clean result.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 68 flagged
- Flagged 1
- No detection 67
- No result 7
- Code signing Unsigned
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The single generic MaxSecure alert is isolated and unsupported by any major antivirus engine, making a false positive likely. One completed sandbox run returned clean, and all observed contacts received full reputation coverage without a malicious or suspicious match, though the unsigned status and two offensive behavior mappings justify normal caution.
Only 1 of the 68 antivirus engines that checked it flagged the executable, and that alert came from MaxSecure with a generic rule-based label. No major antivirus engines detected it, which strongly favors an isolated false positive. The completed sandbox run returned clean, and the fully covered host-reputation check found no malicious or suspicious contacts among the observed hosts. The antivirus analysis found an unpacked, low-entropy .NET executable rather than an obscured payload. However, it is unsigned, and the runtime trace mapped and listed interaction with WMIADAP.EXE, so execution should still be limited to a controlled environment when the source is uncertain.
What We Detected
MaxSecure was the only engine among 75 to flag the file, using the generic label “Trojan.Malware.300983.susgen.” No major antivirus engines reported a detection, and there was no corroborated malware-family or hacking tool identification.
Threat Behavior
One completed sandbox run returned clean. It nevertheless mapped T1548 and T1562.001 and listed interaction with WMIADAP.EXE, so those observations are meaningful counter-signals rather than proof of ordinary behavior. All 16 distinct observed domain and IP contacts were covered by the host-reputation check, with no malicious or suspicious matches; two contacts were identified as analysis-environment background traffic. Three dropped files lack saved verdicts and therefore remain unverified.
What To Do Now
Confirm that the file came from the expected developer or distribution channel and keep security software enabled. If its origin cannot be established, test it only in an isolated environment before using it on a production system.
Where this verdict could be wrong3 caveats
- The executable is unsigned, leaving no verified publisher identity or clean signer history.
- The runtime trace mapped privilege-escalation and security-control-impairment techniques, and listed injection into WMIADAP.EXE; these findings warrant caution despite the clean sandbox verdict.
- Three dropped files have no saved verdict, so their safety remains unverified rather than established.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 68 antivirus engines that checked it raised an alert, and it was a generic less reliable detection.
- No major antivirus engines flagged the sample.
- The completed sandbox run returned clean.
- Every distinct observed network contact received reputation coverage, with no malicious or suspicious match.
- The antivirus analysis found no packer, high-entropy code, or likely-packing indicator.
- The Windows executable is unsigned and has no verified publisher history.
- The test run mapped privilege escalation and impairment of security controls.
- The trace listed interaction with the Windows WMI performance process.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 3spawned processes
- 4network contacts
- 25filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1036
- T1056· Keylogging
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1106
- T1497· Sandbox evasion
- T1548
- T1562.001· Disables security
- T1574.002· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
software.exe"C:\Users\<USER>\Desktop\software.exe"cb6b8bb564640e3d50be10e78986adcc3074cb229b12e9c695d2555668b08745.exe%SAMPLEPATH%\cb6b8bb564640e3d50be10e78986adcc3074cb229b12e9c695d2555668b08745.exeprogram.exe"C:\Users\user\Desktop\program.exe"
Network contacts
44 hosts, listed as 4 addresses. Links show the host and path only.
- IP address
23.32.75.11 - IP address
23.6.103.183 - IP address
23.219.78.81 - IP address
23.46.228.41
Files
20Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db - Written
C:\Users\<USER>\Documents\Outlook Files\New folder - Written
C:\Users\<USER>\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
Show all 20 entries for files
- Written
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - Written
C:\Users\user\AppData\Roaming - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC25.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERED1F.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERED6E.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF52.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF63.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF73.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14FA.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14FC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER150C.tmp.txt - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Registry and auto-start
18Settings the file changed, including ways to start again after a restart.
- Set
HKLM\Software\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading - Set
HKLM\Software\Microsoft\WBEM\CIMOM\List of event-active namespaces - Set
HKLM\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#SW#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{78032B7E-4968-42D3-9F37-287EA86C0AAA}\SymbolicLink - Set
HKLM\SYSTEM\ControlSet001\Control\DeviceClasses\{cac88484-7515-4c03-82e6-71a87abac361}\##?#SW#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{cac88484-7515-4c03-82e6-71a87abac361}\#\Control\Linked - Set
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Counter - Set
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Object List
Show all 18 entries for registry and auto-start
- Set
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Help - Set
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Counter - Set
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Help - Set
HKLM\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\PerfIniFile - Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000_CLASSES\Local Settings\MuiCache\17b\52C64B7E\LanguageList - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\drivers\ndis.sys[MofResourceName] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\System32\Drivers\portcls.SYS[PortclsMof] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] - Set
HKLM\Software\Microsoft\WBEM\WDM\%windir%\system32\DRIVERS\HDAudBus.sys[HDAudioMofName] - Deleted
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUList - Deleted
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupCollapseState - Deleted
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\92\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupCollapseState
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Shell.CMruPidlListLocal\SessionImmersiveColorMutexGlobal\SyncRootManagerLocal\Mutexf01b4d95cf55d32a.automaticDestinations-msShellNewConsolidationMutex
Sandbox background — not the file
16The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM host
res.public.onecdn.static.microsoft - VM host
20.99.132.105 - VM host
20.99.184.37
Show all 16 entries for sandbox background — not the file
- VM host
23.216.147.76 - VM host
20.99.133.109 - VM host
23.216.81.152 - VM host
192.168.0.63 - VM host
20.99.185.48 - VM host
20.99.186.246 - VM host
23.196.145.221 - VM host
a83f:8110:0:0:b00:b00:2800:1800 - VM host
20.69.140.28 - VM host
23.196.193.245
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 996e8240463dcecd7568…7031b5Not checkedno saved verdict
- 11cc2ee269153cdc953f…d690bfNot checkedno saved verdict
- d9c424b884eefeed898f…d0cec3Not checkedno saved verdict
Chapter 04
Technical details
1 of the 68 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
File fingerprint
- Last analyzed
- Oct 15, 2026, 3:52 PM UTC
- SHA-256
cb6b8bb564640e3d50be10e78986adcc3074cb229b12e9c695d2555668b08745- SHA-1
9074cd5f9b81eba0a8e3be2b28aa79897647a406- MD5
59e16d971ff314ecf246b671a4635a4b
About this file
EasyChannelPacking.exe is a Win32 EXE file of 235.5 kB.
- Type and size
- Win32 EXE · 235.5 kB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 21, 2021On VirusTotal.
- Submitted by
- 36 distinct sources
- Packer
- None detected
- Entropy
- 2.83 of 8
First scanned
Antivirus consensus
1 of 68 engines flagged this file
7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is EasyChannelPacking.exe safe?
What is EasyChannelPacking.exe?
How many antivirus engines detected EasyChannelPacking.exe?
What is the SHA-256 hash of EasyChannelPacking.exe?
Is it safe to run EasyChannelPacking.exe?
How up to date is this analysis of EasyChannelPacking.exe?
Community
Member reviews and reports for this exact file hash.