mttaggart / wtfbins

WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.

mttaggart/wtfbins Issues

[New WTFBin]: SecurityHealthService.exe
Closed 21 days ago1
[New WTFBin]: WTFBIN Here
Updated 2 months ago
[New WTFBin]: Update.exe
Updated 2 months ago
[New WTFBin]: Teramind dwm.exe
Updated 3 months ago1
[New WTFBin]: OpenVAS runs WMIExec
Updated 5 months ago
[New WTFBin]: WTFBIN Here
Updated 7 months ago
[New WTFBin]: WTFBIN Here
Updated 7 months ago
[New WTFBin]: IBM Storage Insights Data Collector Runs Batch Script with WMIC Process Call Create
Closed 7 months ago2
[New WTFBin]: Jetbrains IDE using WMI to query antivirus product
Closed 7 months ago2
[New WTFBin]: Cisco Jabber outputs system info to files
Closed 9 months ago8
[New WTFBin]: WTFBIN Here
Closed 9 months ago1
[New WTFBin]: Trojan.exe
Closed 9 months ago2
[New WTFBin]: code.exe spawn cmd.exe
Closed 9 months ago1
[New WTFBin]: WTFBIN Here
Closed 2 years ago6
[New WTFBin]: Nutanix Guest Tools Runs Encoded Powershell Commands
Closed a year ago1
[New WTFBin]: SenseIR Executes Encoded PowerShell
Closed a year ago3
[New WTFBin]: Guest user tries to login whenever a folder gets shared with "Everyone"
Closed a year ago1
[New WTFBin]: PsExec v2.30
Closed 2 years ago4
[New WTFBin]: AdobeUpdateService
Updated 2 years ago1
[New WTFBin]: WTFBIN Here
Closed 2 years ago1
[New WTFBin]: gc_worker.exe
Closed 2 years ago1
[New WTFBin]: iManage Document Protection
Closed 2 years ago1
[New WTFBin]: TrendMicro HostedAgent.exe
Closed 2 years ago1
[New WTFBin]: microsoft.todos.systemtrayextension.exe
Closed 2 years ago1
[New WTFBin]: Avast Antivirus attempts SSH connections to neighbor hosts
Closed 2 years ago1
[New WTFBin]: WTFBIN Here
Closed 2 years ago3
[New WTFBin]: ESET protection suite
Closed 2 years ago3
[New WTFBin]: McAfee antivirus
Closed 2 years ago3
[New WTFBin]: SCS' PowerView.exe triggers PowerSploit's detection
Closed 2 years ago2
[New WTFBin]: SentinelOne
Closed 2 years ago4
[New WTFBin]: Android MobileWips App Makes DNS Query for google[.]com[.]onion
Closed 2 years ago3
[New WTFBin]: logmein.com
Closed 2 years ago1
[New WTFBin]: ArcGIS deploys whoami.exe
Closed 2 years ago1
[New WTFBin]: Snow Inventory Agent (snowagent.exe) runs PowerShell which resembles shellcode
Closed 2 years ago1
[GetPendingUpdates_vbs.CMD]: GetPendingUpdates_vbs.CMD from Solarwinds
Closed 2 years ago2
Rich text for WTFBin Descriptions
Closed 2 years ago2
[New WTFBin]: Suspicious characters in command line arguments for Ivanti Endpoint Manager logging processes
Closed 2 years ago1
[New WTFBin]: WTFBIN bdbicextractor.exe
Closed 3 years ago1
[New WTFBin]: AGMServive.exe LSASS read
Closed 3 years ago1
Powershell_ise.exe
Closed 3 years ago1
[New WTFBin]: WTFBIN Here
Closed 3 years ago1
[Update] Update Nimlang Binaries WTF Bin with this gem of a screenshot
Closed 3 years ago1
[New WTFBin]: Silver Bullet Technology's Ranger runs a Bloodhound.exe
Closed 3 years ago3
Squirrel.exe: (MS Teams)
Closed 3 years ago4
[DameWare Mini Control]: DameWare.exe
Updated 3 years ago2
Cisco AnyConnect: Diagnose Connection Issues, WHOAMI as system
Updated 3 years ago1
[New WTFBin]: RingCentral.exe (Meeting platform)
Closed 3 years ago2
Add common installation paths
Updated 3 years ago
LogMeIn.exe (LogMeIn Product Suite)
Closed 3 years ago2
[New WTFBin]: reader_sl.exe" launches "I run" for no damn reason
Closed 3 years ago3