windows Fallout

conan 1d ago windows

39ff4fcf81b3f754ed73c2ab999a12bf7ac01e90caff3bee4eeb1ad38924ecd2 K₂(Li₂Te)O₈(Er₃AlAsC₃CoIPrS)H₁₀(Cm₂₃Cr₉Db₇DsF₁₉Mg₃Os₁₀Po₁₆Ti₂U₂)Md₅(Bi₈BkPa₂Si₂)

49% Legitimate Conan package manager installer

choco-package-list-backup 1d ago windows

e72fdc7480e073e93674173146c26025d9bdae57675d47785a39faff5aa56bd0 O₃(PCaDy)H₄(CmDbF₄Os₄)

54% scheduled-task.cli

dotcover-cli 2d ago windows

b6fb41008cf004fa99f2b5617108f43a0e054d1f9343be43d44aaa50b0514da8 K₄(AmLi₂McTe₂)O₈(Al₂C₂CaAs₂CoEr₂PrXe)H₁₁(Cm₂₆Os₃₃Cr₃Db₁₄Ds₂F₁₈Hf₃Mg₃Po₂₇TiU₅)Md₈(ArBi₉Bk₃HePa₂Pt₂Si₅)

49% Legitimate JetBrains profiling tool

jruby 2d ago windows

0a2f2049efbacbadb96e24d1cea250758ec42b92b0870417a73b5e264220ea41 O₄(Er₂AsCDy)H₁₀(Cm₃CrDb₂DsF₅HfOs₈Po₆TiU₂)Md₃(Bi₄PaPt)

49% Legitimate JRuby installer package

AdGuard.AdGuardVPN.Beta 2d ago windows

6ee3154c291111142c062ed86ce2fdc97188e9a797c1477199e93726497720cb K₂(AmLi₂)O₅(As₄DyEr₂IPr)H₁₁(Cm₁₇Cr₁₀Db₁₁DsF₁₃Hf₂Mg₂Os₂₅Po₁₂TiU₂)Md₅(Bi₉PaPtSi₃)

49% Legitimate AdGuard VPN installer

46b70348d87262640dd2510b0b6c2d0d9ba9ea1de135c7112405fdf7d08a7efd 4720.4321 2d ago windows

46b70348d87262640dd2510b0b6c2d0d9ba9ea1de135c7112405fdf7d08a7efd K(Te)O₂(CI)H₅(DbF₆Os₅Po₄U)Md₃(Bi₃BkPa)

49% Legitimate Google Chrome installer

Zoho.Ulaa 2d ago windows

a57a8dea26cc43f2be725fcfb07d167cf0ee710ee5ed7af5283b810e76509508 O(As)H₃(DbFPo)Md₃(Bi₃Si₂)

98% Obfuscation markers in legitimate binary

matlab-package-manager 2d ago windows

a308a68e58a6c2f9f2b2475958b7efdc5fa7214649f5c1e5a7536c0fd0699e2c H₂(OsPo)Md₃(PtBi₄Si₂)

54% compiler.systems

firefox-portable 152.0.6 3d ago windows

1423d934cff86c7d49cbb0fa82af5028a1c64cebbb99798a578a2663a47173f6 K₂(Li₅Te₃)O₁₀(As₆C₇Er₇P₂Ca₂CoDy₅I₃Pr₂Xe)H₁₁(Cm₃₈F₂₂Os₃₆Po₂₄Cr₈Db₁₁DsHf₅Mg₃Ti₂U₈)Md₇(Bi₁₃BkPa₂Pt₂Si₂)

54% registry.surfaceip.spoof

GLab.GLab 3d ago windows

345240e38da586f23864bbfed86c250f2cfb435f4e397d43495901e78a356535 O₂(AlC)H₈(CmCr₂Db₄F₂Mg₂Os₆Po₆U)Md₃(Bi₅PaSi₂)

49% Legitimate GitLab installer

PowerShell 3d ago windows

714a8c2377048a565410537fa1985025ce8422f03cf67730c77c4f7443881fff O₃(P₃CDy)H₄(Cm₂F₂Os₄Po₂)Md(Pa)

54% scheduled-task.intervalscheduled-task.cli

b4a1fc36a4ed48c7e50f5b9a403866390fd925c50ae002932e0c9ed203bac7bf 3d ago windows

b4a1fc36a4ed48c7e50f5b9a403866390fd925c50ae002932e0c9ed203bac7bf K₂(Li₂Te)O₄(C₃Er₃IPr)H₁₀(Cm₂₂Cr₈Db₆DsF₁₈Mg₄Os₁₈Po₁₉Ti₂U₂)Md₄(Bi₆Pa₃Si₂)Th

50% Legitimate PyInstaller bundled Python application

c6a65f9c166de99dfa06725fb940610fc4d20a5a3c6f3f7ef6c8c75af058572b 3d ago windows

c6a65f9c166de99dfa06725fb940610fc4d20a5a3c6f3f7ef6c8c75af058572b K₂(Li₂Te)O₄(C₃Er₃IPr)H₁₀(Cm₂₂Cr₈Db₆DsF₁₈Mg₄Os₁₈Po₁₉Ti₂U₂)Md₄(Bi₆Pa₃Si₂)Th

50% Legitimate PyInstaller-bundled Python application

Discord.Discord 4d ago windows

ff1f988536352f742ed3a29c165432622492d797f12cd94836215d9a2b273932 O(As)H₅(Os₃Cm₂DbFPo)Md₂(Bi₃Si₂)

54% binary-metrics.shapeprivilege.check

mkshim 4d ago windows

6cd373c26956436466afe63dfb2b5506100d548f17fb372f29e0480d25daa8ad O(P)H₃(Cm₃OsPo)

80% Mismatched package name in uninstall script

autobrr.upbrr.cli 4d ago windows

36433fd8c600bbb04595f8df06e44e79a76b4edc5b52e4c522e91f864606aa48 K(Li)O₃(ErAlC)H₈(Cm₁₄Cr₇Db₅F₃HfOs₈Po₄Ti)Md₂(Bi)

49% Legitimate torrent automation tool

llmfit 4d ago windows

cb4f57370b535c2337b6c9c8bfaa453500c848e39b5c672fb6ecfb3e38176669 K(Li)O(S)H₉(Cm₁₃Db₄DsF₃MgOs₈Po₇TiU₃)Md₃(Bi₂Pa)

80% Installer pipes remote script to shell

avr-gcc 5d ago windows

de4aad501ee42b63d5d262e45470924cd2654f6bc437f0299875efa6b8d8d0fe K₃(LiMcTe)O₇(C₄AsAlCo₂Dy₂Er₂Xe)H₉(Cm₁₀CrDb₂F₁₂MgOs₃Po₁₂TiU)Md₄(Bi₇Pa₂Pt)

48% Legitimate AVR GCC toolchain

snapraid 5d ago windows

84af790cd25c8f2d773386bca7320cb5cf81706f850eb1fda33d4b9ff4e0d692 O₄(Er₃CCoI)H₉(CmCrDb₂DsF₅Mg₂Os₆Po₁₀Ti)Md₄(Bi₃PaPt)

49% Legitimate SnapRAID and smartctl binaries

Google.Chrome.Canary 5d ago windows

58c8e56a4798286e85affbe220013b98fe3e4aea5a3a05e45134ef245e4c8de8 K₃(AmLi₂Te)O₈(Co₂C₅Ca₃As₄Dy₃Er₄Eu₂Pr₃)H₁₁(Os₂₆Cm₂₁Cr₁₀Db₇Ds₂F₁₃Hf₅Mg₃Po₁₉Ti₂U₂)Md₇(Bi₉PaPtSi₂)Th

49% Legitimate Google Chrome installer

MoSheng.QuickClipboard 5d ago windows

8c7bf3921c07266bcb593f81890c73a411173527158cbae902bbc75d366938ad O₂(CI₂)H₄(F₆Os₅Po₄U)Md₃(Bi₂BkPa)

49% Legitimate installer with standard behaviors

vhdattach 5d ago windows

1edfc92f7b84377652889bffa5653eb0dd8b0fab56ee91d4aba7a992cc988933 O(C₂)H₇(CmDb₃F₂Mg₂Os₃Po₆U)Md₃(Bi₃PaSi₂)

48% Legitimate installer package

NirSoft.SoundVolumeView 5d ago windows

ee2c45553fb9fb31b71db88b537c18e25c1a387a4a9009d081bdb38265c68e1f O₄(CoCIXe)H₇(CmDbF₃Hf₂Os₄Po₅U)Md₂(BiPa)

49% Legitimate NirSoft utility

Google.PlayGames 6d ago windows

5f1335396cc34ab843e60c950847979bcb63d8e7defc774507f03fc6fcd40adb K(Li)O₈(P₃C₃AsDy₃ErEuIPr₂)H₁₀(Cm₇CrDb₅F₉HfMg₂Os₂₀Po₁₂TiU₃)Md₅(Bi₄PaSi₂)

49% Legitimate Google Play Games installer

Microsoft.APM 6d ago windows

1b74a90c7ee6373ab2926addd110c1dbc5934a9675e5f436cac4d04f46cce2f5 K₂(Li₃Te₂)O₉(C₆Al₂AsEr₃ILaP₂PrS)H₁₀(Cm₃₂Cr₈Db₉DsF₂₅Mg₄Os₁₅Po₁₉Ti₂U)Md₅(Bi₇BkPa₅Si₂)

50% Legitimate PyInstaller-packaged application

2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360 6d ago windows

2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360 O₂(CI)H₅(DbF₆Os₅Po₅U)Md₄(Bi₄BkPaPt)

49% Legitimate KL Setup installer

blender-portable 5.2.0 6d ago windows

5892ba62ce3913c910e4528c9c7510c3292ed419291081df91816f2becf67f7a O₄(AlCErI)H₅(DbF₆Os₄Po₄U)Md₄(Bi₃PaSi₂)

49% Legitimate Blender Portable installer

balabolka 6d ago windows

5e58465be9291a43d4348d3d4ab9ea26ef0839b02f07468af6e654bfa6ac1a48 O₂(CI)H₄(PoDbFOs)Md₃(BiPa₂)

54% interpreter.gentee

b2ab8825b84e6f0209cf713dcf7156c93ae82f37a6d9f0ca9072e228825c8d63 6d ago windows

b2ab8825b84e6f0209cf713dcf7156c93ae82f37a6d9f0ca9072e228825c8d63 ✓ O(As)H₃(DbOsPo)Md₃(BiPtSi₃)

80% Obfuscated Go binary with manual API resolution

539ed8f10fd366f7395facb956d33e75a645dbd3cdac506fa731e006242b9a3c 6d ago windows

539ed8f10fd366f7395facb956d33e75a645dbd3cdac506fa731e006242b9a3c ✓ H₃(FMgOs₂)Md(Bi₂)

80% TLS callbacks and memory protection changes

MetaCubeX.Mihomo 6d ago windows

f71736f9c2a17abb8909a726c69ac55279d0cb43d1d9f2c85afdbb70a0f326a3 O₅(Er₂C₂AsDyP)H₆(Cm₂₆Cr₇Db₈F₄Os₁₀Po₆)Md₂(Bi₃)

49% Legitimate proxy client software

ce91001d95ebd45249f7d18f51d75abc51f8093dae104cea05a3c5ca54d10e44 Jul 17 windows

ce91001d95ebd45249f7d18f51d75abc51f8093dae104cea05a3c5ca54d10e44 ✓ O(As₂)Md₃(Bi₅PaSi₃)

80% Themida-packed PE with obfuscated code

4bdde00f03ff8fb972b0320e74ed1f74798002d64261a4077c547706150c4951 Jul 17 windows

4bdde00f03ff8fb972b0320e74ed1f74798002d64261a4077c547706150c4951 O₂(Al₃C)H₈(Cm₃CrDbF₄HfMg₂Os₃Po₆)Md₃(Bi₂PaSi₃)

50% Anti-debug techniques in legitimate tool

color-sustainer Jul 16 windows

b4011a85b12a3b3ab2f8fb2e5a11f7e17fe96ab28c654a4fe59605c84e6a4946 K(Li)O₄(Co₂CIP₂)H₉(Cm₁₀CrDb₂F₅Hf₂MgOs₅Po₈U₂)Md₂(Bi₄Pa)

49% Legitimate software with standard Qt libraries

sysmanage.sysmanage-agent Jul 16 windows

774b1cffb1f447ad1a3ab642dbccdfc0a535d2cf58409f0747fa132437a6b147 Th

80% Installer uses hidden PowerShell execution

9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8 Jul 16 windows

9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8 ✓ K₂(AmLi₂)O₅(C₃As₃AlEr₂S)H₁₀(Cm₁₃Cr₇Db₅F₈HfMgOs₈Po₁₀Ti₂U)Md₅(Bi₇BkPaSi₃)Th

80% Embedded Rufus and CrowdStrike binaries

ae0bee7f6f37f29ef5045919590975cd3ac56f4dabc0dd90a3a83a9b7e434a41 Jul 16 windows

ae0bee7f6f37f29ef5045919590975cd3ac56f4dabc0dd90a3a83a9b7e434a41 ✓ O(C)H₈(CmDbDsF₂MgOs₂Po₄Ti)Md(Bi)Th

80% PyInstaller loader with evasion techniques

jsign Jul 16 windows

f63c4b2a259273bbfba90ac1eb0fd5b887c363d8504c0d98ded7dfd6a86181e7 O₄(CCaAsEr)H₆(Cm₃CrDb₃F₄Po₂Ti)Md(Pa)

50% Legitimate code signing tool

rsync Jul 16 windows

9040c337427b612068df0387960fb99102aaa5eea78e9af08365e246c56a565c K₂(Li₂Te)O₅(Er₂Al₂C₃LaS₂)H₁₀(Cm₁₁Cr₇DbDs₂F₇Mg₂Os₆Po₁₄Ti₂U₂)Md₆(Bi₄HeLiPaPtSi₂)

48% Legitimate rsync distribution binaries

Julialang.Juliaup Jul 15 windows

607b6c9f5aba6b8e82b2ec0790666c3b9321b52936634e26cebb8597d2cb4612 K₂(LiTe)O₁₀(C₉Al₃As₁₃Co₃Er₆DyLaP₂PrS₃)H₁₁(Po₂₂Cm₃₂Cr₁₄Db₁₅Ds₂F₂₅HfMg₃Os₂₄Ti₃U₃)Md₉(Bi₉BkHePa₂Pt₄)

48% Legitimate Julia programming language installer

cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f Jul 15 windows

cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f O₃(CIEr)H₆(DsF₆MgOs₄Po₄U)Md₃(Bi₃PaSi₃)

80% Self-signed PE with NSIS installer

66a1be3919f3f23710ebc6d58daf04e5abd52490f4a95993cea670cfc2314809 Jul 15 windows

66a1be3919f3f23710ebc6d58daf04e5abd52490f4a95993cea670cfc2314809 O₃(CIEr)H₆(DsF₆MgOs₄Po₄U)Md₃(Bi₃PaSi₃)

80% Self-signed installer with NSIS plugins

godot Jul 15 windows

9e943d47cda278da287475bf32ddd59277e507b74657ffb3a56d7512c2141069 O₄(Co₅AsAlI)H₁₁(Cm₇Cr₂DbDsF₉Hf₃MgOs₇Po₁₅TiU₂)Md₄(Bi₃PaPtSi₃)

49% Legitimate Godot engine installer

yt-dlg.portable Jul 15 windows

f0681a911af8005e86db95d7448fa3b08679b711de46e440c3fcfed2c580001a K₂(Li₃Te₂)O₈(Er₃AlAsC₃ILaPrS)H₁₀(Cm₁₉Cr₈Db₄F₁₈Hf₄Mg₂Os₁₅Po₁₈TiU₄)Md₄(Bi₅PaSi₂)

49% Legitimate PyInstaller bundled application

traefik Jul 15 windows

d6d6591df10e1570f89855457c36ed089bbe8184c63781ac8cd605848151157f O₄(I₃AsCLa)H₇(Cm₁₀Cr₇Db₅FMgOs₃Po₅)Md₂(Bi₂)

49% Legitimate Traefik proxy binary

Reqable.Reqable Jul 15 windows

58bf8394f98d5d0b72e4d95a20242e0c8125444b0db886db1ef682152932cf71 O₂(C₂Dy)H₆(Db₃F₂Mg₂Os₃Po₆U)Md₃(Bi₂PaSi₂)

48% Legitimate signed installer binary

hashcheck Jul 15 windows

54d2a5cb269f6e196f79b23c0c42b4c538d1d005bd703fe7f67396282cbf26fa O₄(CCoEr₂I)H₄(F₆Os₅Po₄U)Md₄(Bi₂BkPaSi₂)

49% Legitimate open-source installer

6acc146a3cdb9c7ef0d3af66f3425076f6f945e104295f652bf1eddca867377e Jul 15 windows

6acc146a3cdb9c7ef0d3af66f3425076f6f945e104295f652bf1eddca867377e ✓ K₂(Li₂Te₂)O₇(AsC₄Al₂Er₂ILaPr)H₁₀(Db₆Po₂₀Cm₂₂Cr₁₁DsF₁₇Mg₅Os₁₉Ti₂U)Md₄(Bi₆Pa₃Si₂)Th

80% Obfuscated Python code with XOR decoding

2b466d8674638be5457ae68f98545028ce22e17391a52bd09a1f9df41e4873b7 Jul 15 windows

2b466d8674638be5457ae68f98545028ce22e17391a52bd09a1f9df41e4873b7 ✓ K₂(Li₂Te₂)O₇(As₂C₄AlEr₂ILaPr)H₁₀(Db₇Cm₂₂Cr₁₁DsF₁₇Mg₅Os₁₈Po₁₉Ti₂U)Md₄(Bi₇Pa₃Si₂)Th

80% XOR decoder in Python bytecode

HubDev.HubDev Jul 14 windows

aabf76ca7925727cc14a84f66b904fc28ae8ed97b2cd973f85acd0ef2874f528 O₂(CI₂)H₄(F₆Os₅Po₄U)Md₃(Bi₂BkPa)

49% Legitimate NSIS installer with standard APIs

Google.ChromeRemoteDesktopHost Jul 14 windows

4d4810a9f10b3fc663fb114246328faeceb2e6eb82f32e08a844effadc0c484e O(Al)H₄(DbF₂Os₆Po₈)Md₂(Bi₂Pa)

80% MSI contains anti-analysis and registry manipulation

Forkgram.Forkgram Jul 14 windows

68a7f206db5e8ba32812c91510366eac79fdc105cf9f75d7e075db319f3d2f6b K₂(AmLi)O₁₁(CoIAlAsC₂Ca₂DyEr₂Eu₃PPr)H₁₀(Cm₁₅Cr₁₀Db₃F₈Hf₄Mg₂Os₁₆Po₁₃TiU₂)Md₃(Bi₄Si)

49% Legitimate Telegram Desktop client

vosviewer Jul 14 windows

517617cc130da1fec8301aad0ac7d6cae6ff195ec053f4f52cfe5c90f3e025e3 K(Li)O₈(As₅CCaCo₄I₂Al₂ErP₂)H₉(Cm₁₈Cr₈Db₃F₁₅Hf₂MgOs₆Po₁₁Ti₃)Md₇(Bi₄HePa₂PdPt₂)

49% Legitimate academic software with false positives

e5ce25903af4383079e1378ab0a1b07275631aedcfe4e41df96c2431d598aebb Jul 14 windows

e5ce25903af4383079e1378ab0a1b07275631aedcfe4e41df96c2431d598aebb K₂(TeLi)O₆(Al₄AsCEr₂P₃Dy)H₁₀(Cm₄CrDb₈DsF₂Hf₂MgOs₁₄Po₁₀U₂)Md₆(Bi₆BkPaPtSi₃)

49% Legitimate Connectwise ScreenConnect installer

c361c144166d68555ebee186ba47d4421e6ab4c3330739e1ca3e57f38a438832 Jul 14 windows

c361c144166d68555ebee186ba47d4421e6ab4c3330739e1ca3e57f38a438832 K₂(TeLi)O₆(Al₄AsCEr₂P₃Dy)H₁₀(Cm₄CrDb₈DsF₂Hf₂MgOs₁₄Po₁₀U₂)Md₆(Bi₆BkPaPtSi₃)

49% Legitimate ConnectWise ScreenConnect installer

eb4ca3c1757eb36faa00200c5ce0345a396724c195b33f36563d452d4abcddd7 Jul 14 windows

eb4ca3c1757eb36faa00200c5ce0345a396724c195b33f36563d452d4abcddd7 K₂(TeLi)O₆(Al₄AsCEr₂P₃Dy)H₁₀(Cm₄CrDb₈DsF₂Hf₂MgOs₁₄Po₁₀U₂)Md₆(Bi₆BkPaPtSi₃)

49% Legitimate Connectwise ScreenConnect installer

daca7dff705d30c7f81ae424b54ee528e5559d7d4160eed7ffd357e294bf411e Jul 14 windows

daca7dff705d30c7f81ae424b54ee528e5559d7d4160eed7ffd357e294bf411e K₂(TeLi)O₆(Al₄AsCEr₂P₃Dy)H₁₀(Cm₄CrDb₈DsF₂Hf₂MgOs₁₄Po₁₀U₂)Md₆(Bi₆BkPaPtSi₃)Th₂

49% Legitimate ConnectWise Control installer

IObit.MalwareFighter Jul 14 windows

103d3264de73abdc2c33a4f15ab0c291aa0d8b7318b861cb63cebc630aef6b30 O₄(CP₃DyI₂)H₆(DbF₂Mg₂Os₇Po₆U)Md₃(Bi₄PaSi₃)

49% Legitimate IObit installer with standard features

wez.wezterm.nightly Jul 14 windows

3903e2b49ce809055a9009d9839041fe13340abd65d2aa6a0dfafe56ecd21ca5 O₃(CDyI₂)H₈(CmCr₂Db₃F₂Mg₂Os₄Po₇U)Md₂(Bi₃Pa)

49% Legitimate WezTerm installer binary

97e98f39185696d58e5c5613cbc7af7a3fe912cc961360d0d80414638f7a3728 Jul 14 windows

97e98f39185696d58e5c5613cbc7af7a3fe912cc961360d0d80414638f7a3728 O₂(AsAl)H₇(CmDb₂F₃Mg₂Os₆Po₁₀U)Md₅(Bi₄BkPaSi₃)Th

45% Legitimate .NET runtime host binary

04dcae7c2f31870f4a59ed6faec513a5e252491d911ae9e62b9c3026ccf598cd Jul 14 windows

04dcae7c2f31870f4a59ed6faec513a5e252491d911ae9e62b9c3026ccf598cd ✓ O₃(AlAsEr)H₄(DbMgOs₃Ti)Md₃(Bi₂PaSi₃)

80% Obfuscated Go binary with anti-analysis probes

13eabc99acd666de32c3db953f8416543a3fa7f86a18b922adda6f3b1045ab1d Jul 14 windows

13eabc99acd666de32c3db953f8416543a3fa7f86a18b922adda6f3b1045ab1d O₃(CDyI)H₇(Cr₂Db₃F₂Mg₂Os₄Po₆U)Md₂(Bi₃Pa)

49% Legitimate Inno Setup installer binary

portainer Jul 14 windows

23d0b1f6ae5cddd3d80c3c3b295ff474687c8b6dc74c6e5abae070b4004839f8 O₆(C₂AlDyILaS)H₁₁(Cm₂₅Cr₄Db₁₀DsF₃HfMgOs₁₂Po₉U₂)Md₅(Bi₂)

50% Legitimate Portainer container management software

fb53841dd09252611470ab59b7455cb8a25679ee145d65210ffb179167a6f452 Jul 13 windows

fb53841dd09252611470ab59b7455cb8a25679ee145d65210ffb179167a6f452 O(As)H₃(DsOsPo)Md₃(BiPtSi₃)

54% name-mangling.type-namesbinary.layout

schemasmith Jul 13 windows

2ba6d35614626a422ccf1ced68e00bf70b373d309cb961a3b840eb1d4b05aa7f K(Te)O₇(As₃Er₂Al₂C₂EuIPr)H₈(Cm₁₃Cr₃Db₁₀F₈Mg₃Os₁₃Po₁₁U)Md₅(Bi₅BkPa₂Si₃)

49% Legitimate database tool with standard libraries

universal-usb-installer Jul 13 windows

dfff155bd57011382a65c12669fae3cbd51569a3eeb72fe93659f4271a0d8a7f O₄(CCo₂ErI)H₄(F₅Os₆Po₄U)Md₃(Bi₂BkPa)

49% Legitimate USB installer software

laurentiu021.SysManager Jul 13 windows

b4c26f0a8188e0bd1667e28d87f789756c898425934978d4709ad35a9569936b O₂(AsAl)H₈(Cm₂Db₂F₃HfMg₂Os₆Po₁₀U)Md₄(Bi₇PaSi₃)Th

45% Legitimate .NET runtime with embedded libraries

532af7026091f1b8eea917ef49903baaa68aca440b334cee8ac22ec7c56aae62 Jul 13 windows

532af7026091f1b8eea917ef49903baaa68aca440b334cee8ac22ec7c56aae62 O(I)H₅(F₆HfOs₄Po₄U)Md₅(Bi₂PaPtSi₃)

80% Installer with high-entropy overlay

balsamiqmockups3 Jul 13 windows

ff52a0b60a990bb3d57106d36ab4e27feb8107256ee443cf05a2d46ffebdd08f O₁₀(Co₂AsC₄Al₂CaDy₂Er₂EuI₃P₂)H₁₀(Cm₁₄Os₁₄Cr₆Db₃F₁₁Hf₄MgPo₁₄Ti₂U₂)Md₄(Bi₄PaSi₃)

49% Legitimate Balsamiq Mockups installer

Proton.ProtonVPN Jul 13 windows

32b43381b9e533c091e1df58f823e30e871b7f818ef417f2e3fea2d4de24407a O₄(CCaDy₂I)H₈(CmCr₂DbF₄Mg₂Os₇Po₈U)Md₃(Bi₄PaSi₃)

49% Legitimate ProtonVPN installer

3b328b13d6925bb86cfa46b58586530dd14e6f0f627ec92a1f14ef162d5712ec Jul 13 windows

3b328b13d6925bb86cfa46b58586530dd14e6f0f627ec92a1f14ef162d5712ec O(As₂)H₃(OsCrF)Md(Bi)

54% api-resolution.hash-basedpayload.section

937c16c2f853b605c2be68982a65109fcd5f2cdf704b9438cd254a38ff529b7f Jul 13 windows

937c16c2f853b605c2be68982a65109fcd5f2cdf704b9438cd254a38ff529b7f ✓ H₇(CmDb₂F₃Hf₂Os₄PoU₂)Md₅(Bi₂PaSi₂)

80% Qihoo 360 with zeroed checksum

e751d7b5e521b7a544cce47a50094e46226f842014ff0ae7ac0e249bf83ef4ac Jul 13 windows

e751d7b5e521b7a544cce47a50094e46226f842014ff0ae7ac0e249bf83ef4ac ✓ O(As)H₅(CmCr₂DbPoTi)Md(Bi)Th

80% Go binary heavily obfuscated with Garble

voltdesk Jul 13 windows

83ae72c7106e87c860e6799d0b0ac826ae5a3b110fabf2f8375a9cb9ad315578 O₄(CDyErI)H₈(CmCrDb₃F₂Mg₂Os₄Po₇U)Md₂(Bi₄Pa)

49% Inno installer with crypto and reflection

far Jul 13 windows

907758e5c3db64124a5d21c50e6aa06efa10ad5050db154177d635e02d8a0226 K₂(Li₂Te)O₁₂(CaDy₄EuAl₃AsC₇Co₃Er₂LaPrS₂Xe)H₁₀(Cm₁₅Cr₆Db₆DsF₁₇HfMg₂Os₁₇Po₁₆Ti)Md₄(Bi₂PaPt₂)

50% Legitimate Far Manager software suite

gitversion Jul 13 windows

13d95502e3888055df077ed4383ed2e010ec659a3a0f0b3db726e9d7a8fa6724 O₆(As₄C₅ErAl₂CaEu)H₈(Cm₉CrDb₈F₈Mg₃Os₁₀Po₁₀U)Md₄(Bi₄BkPa)

49% Legitimate .NET runtime host binary

RedEyeNetworks.Logivore Jul 12 windows

2dc3b3e08220460378574616fe8f296d1e703e33523458c97a3d712b813a3169 O₄(CDyErI₂)H₈(CmCrDb₃F₂Mg₂Os₄Po₅U)Md₂(Bi₅Pa)

49% Legitimate Inno Setup installer binary

GodotLauncher.Launcher Jul 12 windows

f20f9a276cd1ac9a015ffaebeeb7e3f8b42312e9735e84796f72ea739e28391d K₃(AmLi₄Te)O₁₂(C₅S₆Al₃As₅CaCo₄Dy₃Er₂EuP₄PrXe)H₁₂(Db₁₉Cm₃₅Cr₈Ds₂F₂₁Hf₄Mg₂Os₂₈Po₃₀Ti₃U₆)Md₁₀(Bi₁₁BkInLi₆Pa₁₄Pt₃Si₂)

54% backdoor.evasivehidden-payload.encoding

payhereinc.PayhereSeller Jul 12 windows

a785133e90e2b392883f3606b1263d65c1ddeea21237991974d317dd240b50e7 O₃(DyIPr)H₅(CmF₅Os₈Po₅U)Md₇(Bi₃BkPaSi₃)Th

45% Legitimate installer with standard behaviors

Tencent.DeskGo Jul 11 windows

e40389e93ebbef16339dd8b9a7b27050800d9079be829fff7e6915df008bba98 O₃(As₃CI)H₃(CmMgOs)Md₃(Bi₃PaSi₃)Th

50% Packed binary with anti-analysis indicators

jack Jul 11 windows

beea97f639511cb8201b4e5348088eb764b75a14fc628d6000a347c4049c50eb O₂(C₃Er₂)H₆(Db₃FMg₂Os₄Po₇U)Md₂(BiPa₂)

48% Legitimate JACK audio installer

PLFJY.ContextMenuMgrPlus.Beta Jul 11 windows

4a70faa1db9c356a2f92c24ebd614bf4856dadf8af404efc9437a7cc4091766e O₅(C₂AsDyErI₂)H₈(CmCrDb₃F₂Mg₂Os₄Po₅U)Md₂(Bi₃Pa)

49% Legitimate Inno Setup installer

kicad-portable 10.0.3 Jul 10 windows

a9ce135908e46c92eb6ac07278e3952d8c6e0e5fd15e99f7db468bf565fb37ee O₃(AlErI)H₄(F₆Os₄Po₄U)Md₄(Bi₃PaSi₃)

49% Legitimate KiCad Portable installer

gnucash-portable 5.16 Jul 10 windows

0a7e1840a13c87d55c431166847896837468b960f12292ee1184ed8a5fb5def3 K₂(LiTe₂)O₁₂(C₁₂Er₉AlAs₆Ca₅Co₅Dy₂EuI₄LaPrXe₃)H₁₁(Cm₃₁Cr₁₂Db₁₂DsF₂₂Hf₅Mg₂Os₂₂Po₁₉Ti₃U₅)Md₈(Bi₁₅BkPaPtSi₃)

54% file.luresection.metrics

xiaoyifang.GoldenDict-ng Jul 10 windows

8225752610bc6f3669c5a07df6f14ce05a538ed3a97ee789c06efd4ff17f09e2 O₄(CAsIS)H₅(Db₂F₆Os₅Po₄U)Md₃(Bi₃Bk)

49% Legitimate software installer

NordSecurity.NordVPN Jul 10 windows

b000fe1ccd6ac286b25fc4d0023f0f43938c6c81ddfcb64762bc4705a1b0fdd6 O₅(C₃CoDyErI)H₆(DbF₂Mg₂Os₄Po₅U)Md₃(Bi₄PaSi₃)

49% Legitimate NordVPN installer

FactoryAI.Factory Jul 10 windows

32e91f20b48f1f0309a367d268061851c9bf4e42cdcfdb6a05d05aa7a9eecece O₂(AsP₂)H₄(CmFOs₃Po)Md₃(Bi₃Si₃)

80% Installer with obfuscation and download capabilities

19b380d379426553e87f6e6a822169e02f7b1675cf18d629ebdedb9d098f3d50 Jul 10 windows

19b380d379426553e87f6e6a822169e02f7b1675cf18d629ebdedb9d098f3d50 O₅(AsCCoErI)H₄(F₅Os₇Po₄U)Md₂(Bi₃Bk)

80% Installer with admin rights and syscalls

Session.Session Jul 10 windows

41833b4f71a115e2fed43ca27222b57d31cef96616292db48b9382b97350601f O₄(AsC₂CoI)H₄(F₅Os₆Po₄U)Md₃(Bi₃Si₂)

80% VM detection in legitimate installer

d632a7428a5a8a6c4642ba4ddecfbbe96e28ed030a204156c5018527ba4a6b46 Jul 9 windows

d632a7428a5a8a6c4642ba4ddecfbbe96e28ed030a204156c5018527ba4a6b46 O₂(AsC)H(Db)Md(Bi)

80% UPX packed executable

d9e8f073c050b9f75f78003c05cc77bc0b60fb5bbdfb980fe6216fa0fd8ace6a Jul 9 windows

d9e8f073c050b9f75f78003c05cc77bc0b60fb5bbdfb980fe6216fa0fd8ace6a O₂(AsC)H(Db)Md(Bi)

80% UPX packed executable

MarkusKellermann.Convo Jul 9 windows

09a08d78e065de068cc52178004ab756102112e12ca27809baa192e6c13c6228 O₃(C₂CoI₂)H₄(F₅Os₇Po₄U)Md₃(Bi₃Si₂)

80% Installer with aggressive system APIs

595e3d46169a51dcf93d15690d34508726729c6f6cdfec88b5e366070934537d Jul 9 windows

595e3d46169a51dcf93d15690d34508726729c6f6cdfec88b5e366070934537d O(As)H₂(DbMg)Md(Bi)

80% Executable memory allocation and unpacking patterns

kiota Jul 9 windows

6c49cd83cddbd7ea3a908f22234f36b5b475f1c11b2233a0e3967659ddf36884 O₅(As₂Al₂C₂ErEu)H₈(Cm₁₁CrDb₉F₈Mg₃Os₁₂Po₁₁U)Md₅(Bi₄BkPaSi₃)

49% Legitimate Microsoft Kiota CLI tool

Anydo.Anydo Jul 9 windows

4acb4a8c9b5135e3498f1299d34899437c2e5ba997262448af2c37c39becb205 O₄(CCoErI)H₄(F₅Os₆Po₄U)Md₄(Bi₃PaSi₃)

80% Installer contains worm/syscall references

31999f391b5f13ce5bbd3e6a7c96667625eb4cc21e2e700acb307f1b59a50c63 Jul 9 windows

31999f391b5f13ce5bbd3e6a7c96667625eb4cc21e2e700acb307f1b59a50c63 O(As)H(Db)Md(Si₃)

80% Self-signed PE with high entropy

Dais.Dais Jul 9 windows

3d462e1c1646dd0beb1a90840c2064ce1a87b40152ef895910307fafa5df812b O₄(AsC₂Co₂I₂)H₅(CmF₅Os₅Po₄U)Md₂(Bi₃)

80% Installer with clipboard and key targeting

googlechrome Jul 8 windows

f464b9c1adffe89d91db23c1506f90a92241f7d0199dff1ed489d65baa8f8456 K₃(AmLi₂Te₂)O₈(Co₂Er₃C₅Ca₂As₂Dy₂Eu₂Pr₂)H₁₁(Os₂₇Cm₁₇Cr₈Db₃Ds₂F₁₁Hf₆Mg₃Po₁₉Ti₂U₂)Md₇(Bi₉PaPtSi₃)Th

50% Legitimate Google Chrome installer

e30e9845752501617a284f8b48d1b79b51cccbbfe04cfa513955c1e755320806 Jul 8 windows

e30e9845752501617a284f8b48d1b79b51cccbbfe04cfa513955c1e755320806 K₂(Li₂Te)O₉(C₉Eu₂As₈Al₄DyEr₂LaPPr)H₁₁(F₉Cm₁₃Cr₈Db₄DsHfMg₂Os₁₄Po₁₅TiU)Md₄(Bi₅Pt₂Si₂)Th

80% PyArmor obfuscation and embedded RAR archive

AtomGit.AtomCode Jul 8 windows

bd324932650a0c60cb992240c4f31926bf8c58129776534d0c3dfebd69f0ca63 K(Li₂)O₃(As₃C₂Er)H₇(Cm₈DbF₈Os₇Po₇TiU₂)Md₃(BiSi₂)

80% Credential scanning and high-entropy payload