File scan report

Verdict Suspicious

Analyzed Nov 10, 20265 hours ago

Is windowsraper.exe safe? Treat it as suspicious.

An unsigned, rarely seen Python-bundled executable flagged by 17 of the 71 antivirus engines that checked it, including several major ones, though sandbox runs showed no clearly malicious behaviour.

Why Suspicious? 17 antivirus engines flag it; nothing else confirms it.

Limited evidence · One sign points to a problem; nothing else confirms it.

Don't run it until you know where it came from

Avoid running this file unless you know and trust its source, and keep your antivirus protection enabled. If you must test it, do so in an isolated virtual machine.

What to do now4 steps

Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.

What to do

Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.

If you already ran it

Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

Not sure what to do?

Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Antivirus results

17 of 71 flagged

Flagged 17
No detection 54
No result 4

Filewindowsraper.exe13.2 MBSHA-256 ef8285c00b4d…dea189

Code signing Unsigned
Test run Completed
First seen 1mo ago

17 of the 71 antivirus engines that checked it flag it, including Microsoft and Avast.

Chapter 02

Why we think so

4 points against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

17 of the 71 antivirus engines that checked it flag this unsigned executable, including Microsoft, Avast, Avira and Symantec, mostly with generic trojan or password-stealer labels. Sandbox runs came back clean and showed a bundled Python script, so the evidence is mixed. Treat it with caution.

Full reasoning

Five major antivirus engines flag the file, with labels pointing to a trojan or password-stealer, which is a real concern. The labels are generic and name no common family, so there is no strong consensus. In the sandbox the program unpacks and runs a bundled Python script, and the combined sandbox verdict was clean, with no injected processes or credential-store access recorded. The file is unsigned, was submitted by a single source, and has no reference database hit. Our own inspection of the file contents did not take place. Together this is too uncertain to call safe and not conclusive enough to call malicious.

Detailed assessment

What We Detected

17 of the 71 antivirus engines that checked it flag the file, including Microsoft, Avast, AVG, Avira, F-Secure, Ikarus and Symantec. Labels are generic trojan, password-stealer and machine-learning detections.

Threat Behavior

In the sandbox the executable starts a bundled Python interpreter and runs a script named windowsraper.py. The combined sandbox verdict was clean, no process injection target was recorded, and several credential-related technique mappings had no supporting artefact. It contacted only a Microsoft Teams file host.

What To Do Now

Do not run it outside an isolated environment unless you trust its source. Keep your antivirus protection enabled.

Where this verdict could be wrong3 caveats

The combined sandbox verdict was clean and no injected process or credential-store access was recorded.
The detection labels are generic and no strong consensus on a named family exists.
No MalwareBazaar, YARAify or CIRCL hit corroborates the detections.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour

Combined sandbox verdict was clean across 4 runs
No injected processes or persistence recorded
Only one contacted host, a Microsoft Teams file host, with no bad reputation

Points against

Several major antivirus engines flag it as a trojan or password stealer
Unsigned file submitted by only one source
Python-bundled executable whose script contents were not inspected
Generic detection labels with no clearly identified family

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 4 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete

4isolated sandbox runs
25sandbox rule tags
4spawned processes
1network contact
26filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.

Sandbox labels we could not confirm (common in safe files too)

Not confirmed: A sandbox rule tagged this run as password-store access, but nothing touched the Windows password store.
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.
Not confirmed: A sandbox rule tagged this run as searching for passwords; no password file was read.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

Input file
The submitted object
1
1. Evidence 1 of 6: FileSeen in the test run
  windowsraper.exe
  ef8285c00b4d4dd3a85954e81387f9f7418782585b877aaa8712662a20dea189
  Uploaded file
Processes
What ran
2
1. Evidence 2 of 6: ProcessSeen in the test run
  OpenWith.exe
  C:\Windows\system32\OpenWith.exe -Embedding
  Test run
2. Evidence 3 of 6: ProcessSeen in the test run
  windowsraper.exe
  "C:\Users\<USER>\Desktop\windowsraper.exe"
  Test run
3. +1 more recorded observation
Files
Created or changed
2
1. Evidence 4 of 6: Written fileSeen in the test run
  thumbcache_idx.db
  C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
  Test run
2. Evidence 5 of 6: Written fileSeen in the test run
  thumbcache_32.db
  C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
  Test run
3. +1 more recorded observation
Network
Hosts contacted
1
1. Evidence 6 of 6: Contacted hostSeen in the test run
  teams-fs.office.com
  Contacted during the test run.
  Test run

6 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was detonated in 4 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEANclean

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1003· Credential theft
T1005
T1027· Obfuscated code
T1033· Reads user info
T1036
T1055· Process injection
T1059· Runs commands
T1069
T1070.006· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1129· Loads modules
T1485
T1486· File encryption
T1497· Sandbox evasion
T1497.001· Sandbox evasion
T1539
T1552· Credential search
T1552.001· Credential search
T1555· Password stealing
T1555.003· Password stealing
T1562· Disables security
T1562.001· Disables security
T1574· Execution hijack

Observed activity

Processes started

Programs the file ran, with their command lines.

OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding
windowsraper.exe"C:\Users\<USER>\Desktop\windowsraper.exe"
python.exe"C:\Users\<USER>\AppData\Local\runcell-pyexe\a7c8a3ef8bdab33218b001d037978980\python\python.exe" C:\Users\<USER>\AppData\Local\runcell-pyexe\a7c8a3ef8bdab33218b001d037978980\app/windowsraper.py
windowsraper.exe"C:\Users\user\Desktop\windowsraper.exe"

Network contacts

1 host, listed as 1 domain. Links show the host and path only.

Domainteams-fs.office.com

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\python.exe

Show all 16 entries

WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\pythonw.exe
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\python3.dll
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\vcruntime140.dll
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\vcruntime140_1.dll
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\LICENSE.txt
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\pyexpat.pyd
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\select.pyd
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\winsound.pyd
WrittenC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500\python\_asyncio.pyd
DeletedC:\Users\<USER>\AppData\Local\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-3096-1790191754879560500

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\SessionImmersiveColorMutex
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_16.db!dfMaintainer
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_32.db!dfMaintainer
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_48.db!dfMaintainer
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_96.db!dfMaintainer

Show all 10 entries

Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_256.db!dfMaintainer
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_768.db!dfMaintainer
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1280.db!dfMaintainer
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1920.db!dfMaintainer

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processDllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
VM processservices.exeC:\Windows\system32\services.exe
VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost

Show all 10 entries

VM processlsass.exeC:\Windows\system32\lsass.exe
VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
VM processconhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.

1 clean9 not checked

eff52743773eb550fcc6…7b280aClean
trust 85known-software reference set · not scanned here
b17a87979862d19241ed…311001Not checked
no saved verdict
03168c01b7b749142335…3a0c38Not checked
no saved verdict
22c6e46d8bd563cdb072…a27e39Not checked
no saved verdict
e3889c5020644b9ecfd9…1d0972Not checked
no saved verdict
052ad6a20d375957e82a…5027f4Not checked
no saved verdict
23efd126788d80336c12…687576Not checked
no saved verdict
42410825f91cffb2220a…c91a0cNot checked
no saved verdict
85770a8df603212789cb…91eb44Not checked
no saved verdict
7e8b8ff7b1475e6368aa…648020Not checked
no saved verdict

Chapter 04

Technical details

17 of the 71 antivirus engines that checked it flag it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete17 of 71 engines flagged it · 4 gave no result DetailsSep 23, 2026

Sandbox runVirusTotal sandboxes · C2AE, CAPA, CAPE SandboxComplete4 runs: 1 clean, 3 without a verdict DetailsNov 10, 2026

Contacted hostsMalwareTips URL scannerComplete1 contacted host checked DetailsNov 10, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete2 MalwareTips behaviour rules DetailsNov 10, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedNov 10, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchNov 10, 2026

Engines that flagged it 17

Avast (major engine)Win64:MalwareX-gen [Pws]
AVG (major engine)Win64:MalwareX-gen [Pws]
Avira (major engine)TR/W64.MalwareX
F-Secure (major engine)Trojan.TR/W64.MalwareX
Ikarus (major engine)Trojan.Win64.Crypt
Microsoft (major engine)Trojan:Win32/Egairtigado!rfn
Symantec (major engine)ML.Attribute.HighConfidence
Antiy-AVLTrojan/Win32.Agent

9 more in the full engine list

File fingerprint

Last analyzed: Nov 10, 2026, 11:27 PM UTC

SHA-256: ef8285c00b4d4dd3a85954e81387f9f7418782585b877aaa8712662a20dea189
SHA-1: 2137bf008916196c6c75d174195c38bdaa093149
MD5: a2daf8219f31fa27bbf773a0cf271a73

About this file

windowsraper.exe is a Win32 EXE file of 13.2 MB.

Type and size: Win32 EXE · 13.2 MB
Signer: UnsignedNo code signature.
First seen: Sep 23, 2026On VirusTotal.
Submitted by: 1 sourceRarely seen: few people have submitted this exact file.
Packer: None detected
Entropy: 6.42 of 8

First scanned Nov 10, 2026

Antivirus consensus

17 of 71 engines flagged this file

17 malicious0 suspicious54 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

The 17 detections come from 14 independent scan engines: several vendors license the same engine, so their results are one vote.

Tier-118 engines
5flagged
7 vendors sharing 5 engines
Tier-236 engines
7flagged
8 vendors sharing 7 engines
Low-trust17 engines
2flagged

View all 75 engine results

Antiy-AVLMalicious: Trojan/Win32.Agent
AvastMalicious: Win64:MalwareX-gen [Pws]
AVGMalicious: Win64:MalwareX-gen [Pws]
AviraMalicious: TR/W64.MalwareX
DeepInstinctMalicious: MALICIOUS
ElasticMalicious: malicious (high confidence)
F-SecureMalicious: Trojan.TR/W64.MalwareX
GoogleMalicious: Detected
GridinsoftMalicious: Trojan.Win64.Agent.oa!s1
IkarusMalicious: Trojan.Win64.Crypt
K7AntiVirusMalicious: Riskware ( 00584baa1 )
K7GWMalicious: Riskware ( 00584baa1 )
MalwarebytesMalicious: Malware.AI.2553232207
McAfeeDMalicious: ti!EF8285C00B4D
MicrosoftMalicious: Trojan:Win32/Egairtigado!rfn
PandaMalicious: Trj/GdSda.A
SymantecMalicious: ML.Attribute.HighConfidence
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
APEXClean
ArcabitClean
Avast-MobileNo result
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DrWebClean
EmsisoftClean
ESET-NOD32Clean
FortinetClean
GDataClean
huorongClean
JiangminClean
KasperskyClean
KingsoftClean
LionicClean
MaxSecureClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

2 heuristics

MITRE ATT&CK profile

Defense evasion× 1Cred access× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)
CredentialDumper
T1003 T1003.001
low
VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
Evidence
T1003 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 6.42Unpacked

Section entropy6 sections

.text

6.38

.rdata

6.65

.data

1.58

.pdata

5.64

.tls

0.02

.reloc

4.79

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.

Rare & old

Unique uploaders

Very few people have ever uploaded this — rare.

Total submissions

Includes repeat uploads by the same source.

First seen

2mo ago

Sep 23, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

here

Rare · Old

Niche or internal tooling

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is windowsraper.exe safe, or is it malware?

windowsraper.exe is rated Suspicious: some signs point to a problem, but nothing confirms it is harmful. 17 of the 71 antivirus engines that checked it flag it. Don't run it unless you're sure where it came from. If you need the program, download it again from the publisher's own website.

What is windowsraper.exe?

windowsraper.exe is a Windows program, about 13.2 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Sep 23, 2026.

How many antivirus engines detected windowsraper.exe?

17 of the 71 antivirus engines that checked it flag windowsraper.exe, including Microsoft and Avast. We weigh which engines flagged it and what else the scan found, not just the count.

What should I do if I already ran windowsraper.exe?

No infection is confirmed: the rating is a caution, not a malware finding. 1) Check where it came from. If you can't confirm the source, delete it. 2) Run a full scan with your security software. 3) If the scan finds something, follow its removal steps and change passwords you typed on the device since then.

What is the SHA-256 hash of windowsraper.exe?

The SHA-256 fingerprint of windowsraper.exe is ef8285c00b4d4dd3a85954e81387f9f7418782585b877aaa8712662a20dea189, and its MD5 is a2daf8219f31fa27bbf773a0cf271a73. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

How up to date is this analysis of windowsraper.exe?

This report reflects the scan on Nov 10, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is windowsraper.exe safe? Treat it as suspicious.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

What happened in the test

Input file

Processes

Files

Network

What this file did when executed

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 17

File fingerprint

About this file

17 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is windowsraper.exe safe? Treat it as suspicious.

What We Detected

Threat Behavior

What To Do Now

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

What happened in the test

Input file

Processes

Files

Network

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Engines that flagged it 17

File fingerprint

About this file

Related file reports