38a408d45d4f100e6d1a1cc5c97901bde0bd3f2d9252b3aa01d54bdfaedc2739
windows Fallout
Recently scanned open-source supply-chain artifacts and public lab uploads.
Files indexed
88,999,504
84494fb8646ae7767ec6eceb2b6627fa6b86c571000a73337676f0bd558f4921
3eaec171f6aca1bc703574ef4be558b1c1002c52b4df511b8fd398ce431cb772
Md(Pa)
3b06541e8112306c27c8fae36cb71afa772580289c96e0735bc98932a820fcc0
3661df6ee7dff7e7f4d6291299f2b24766bf33254a48c741105a8cf7b8aed27a
H₂(Cm₂Os₂)
98c5d0d9a40e4ca7490456eb926ed8e612d54ad15071d48ff2785143e870047b
349c3e59063810a82452928affb55b699bb278bdf23ccf0ad9c49cd828a5e6c1
Md(Pa)
30ddb97838ee8fd3ecfba3f284450542185cc58280b77329ebe79b8ff8929701
3251068f9b2406475127a785ea59884a3af8471a7626cbf57c4aa26f5567a222
a0c95a82f0225b7080a2cc3403b93b901dd44530fe7fad8694ecef5eca8d4b4e
H₂(DbU)
2f67fc37cc73f2625abb2c798a0baf886453e2a32ec96fa4ea0b82ffc0b334e4
23cf7dd53a2df9bf629c9baf448a47f2ec2829869ebd98c09db28db6afc30a6d
1b15ba77cd3f51cd7ccfd60189329b935c408f9a3a3310913c9dc64571603d2d
2726e3a94b1bd8470a0d587312ff43e21f5678b431da128c5182c5e481db43c6
17ae5c6e2c667677801b8089c2bf1837022dc6a3f0e2e4061ae3724600314b55
0d0aa126e8b6cd42365cae54adb3286b29c16418382076c71e92b255b0be9640
0908531ecff45ab01ef74a3bc809d019d3f34d956d5c1f4dce24a45a3e881cd4
H₂(FU)
d5c58007f55abb6a0a1efa40d35598e49dac9546fb1d4b9b5f8a18982ee135ce
15cc18085eaca118c27e84a0070715590b60aa0525917e90dc1c86c48c23829e
0990b2ddaab3820a0fa75c087cd969f84b43dfab04e22f0a91207152eb64654c
12caa91f44c4322e7de99a9e20c37875bd72053c1fb1d4463c12aeaa46782bc8
H(U)
dcbe0581b28998d0678c9cf6b416288e5c5165eca9ace75198c489d1016468c8
H₂(DbOs)
0c6912841a248355134fa0d1cfaabded7fcfbe59f1a0393f518869c3762795b1
04ca179e7d104d3aae58972e395a749d13fad1ae2ae1dd9e27f7bc1c5466f845
05e379b53b1b5bfa5fb103b4baf7021de441fc57061752349d5a6ccc601d3367
ed905d4ef4ee70406d64cae33be4010467d5caeba4d3df495cf66dcd641b442a
053094c32ccb8e1aca2e21bdfd7c18d3a57562d99f89724aa635d1e134b415a6
fe281924c7ad9c7c970cc56c2737114b450f1e085929a1878b446788f411081d
ef7128bd31cac09dcfb3308431130ecb1464773bce7972b313149eca32c6cc7d
fe1e3f38e6bd2ec3cfcacc946a22c8d8212f083c8165cb3caa9ae301c25332ff
✓
O₃(Er₃IAs)H₄(Cr₃Db₄Os₄Po₄)Md₃(Bi₄BkPt)
100%
Embedded malware, EDR killer, vulnerable driver
2c355642547e30bc702280efc25646ac33db35a49649d3abc6af5e8e9c339199
K(Li₂)O₄(C₄EuAs₂Er₃)H₁₀(F₉Cm₁₅Cr₉Db₆DsMg₃Os₁₆Po₁₆Ti₂U₂)Md₆(Bi₈PaPt₂Si₂)Th
92%
staging.embeddedstealer.package
45d63acb6e4a767b49b9769eb8db1090fcfc62c87fda71bc291f1e9427c8de66
O₂(As₃C)H₅(Cm₂FMgPo₂U)Md(Bi₃)
100%
execution.loaderpack.entropy
ba99284ae9ef01288395aa82d1f5f219aa8b75e2b266d9c8d5a3ab2f81ea9f37
O(Al)H₆(Db₂DsF₃MgOs₃Po₄)Md₂(Bi₄Pa)
77%
Legitimate Oracle ODBC installer binaries
c37f1a8b47258129d6ca40987fb2cedcd5109856492927526cb5395b07f30864
O(Al)H₃(DbF₃Os)
48%
Oracle SDK legitimate files
5095f5a21292e9ff05209199780e3c6627a90f00625565ec5267a78f11dde3a4
O₂(CEr)H₅(Cm₈DbF₃Po₃Ti)Md
100%
Malware dropper with SSL bypass
d33682b92ddee2be9ab8dce71d6940cf17084571a869cf3e6cebe2f8a41137ef
O₂(AsCo₂)H₃(HfOs₄U)Md(Bi₂)
99%
Malware captures screen and clipboard data
dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140
K(Mc)O(As₄)Md(Bi₃)
92%
pack.runtimestring.conceal
6b70026b99b60a9bf104d6bd954a8a716c2038ac0074458bf190c61bab544cc8
O₂(AsXe)H₂(DbPo₇)Md₂
100%
obfuscation.multi-layereval.invoke
b2499ca307b9903a6694e13648c6453e4c1f1d50e208b8107b89704a1e81847d
O₂(AlCo₂)H₃(HfOs₄U)Md(Bi₂)
98%
Malware with anti-analysis and data exfiltration
85%
Obfuscated PowerShell executing decoded payload
872d8079ab450bfd1417b9128b619f7e9b43291dc7391044dd838f5b7e8dde52
O₂(Er₂As₂)H₄(DbMgOs₂Po)Md₃(Pt₃Bi₂Si₃)
92%
injection.shellcodecompiler.systems
1cdbb37dde622d4228c77ee75284bd2194c7301cbf15a5351e79aeec22ffbd1f
O₂(CEr)H₅(Cm₈DbF₃Po₃Ti)Md
100%
security-bypass.tlsdelivery.download-execute
100%
Downloads and executes remote payload
100%
Malicious downloader with certificate validation bypass
85%
Stealer with anti-analysis and importless loader
7914112ecc6d393e36517e35d5f1e87d4b101e58a7846de0f7718900b3292aa4
O₂(AsXe)H₃(DbFPo₆)Md₂
99%
Obfuscated PowerShell executes decoded malicious payload
d068e55eb7c1be1c2c28110eb731f124e511bfc6be9805173d146b1f055428a8
O₂(AlC)H₇(Cr₂Db₄F₂Mg₂Os₆Po₆U)Md₂(Bi₅Pa)
92%
staging.embeddeddebugger-detect.check
25787f5541566d193f35b220b4953a6057aabc05a54bf9b7cf903fb8fdf26912
O₄(AlErCAs)H₅(CmDb₃OsPo₄U)Md₆(Bi₃BkPaPtSi₂)
92%
sandbox-detect.suiteinjection.shellcode
100%
Obfuscated payload execution via temp file
8999b5f6aca21db5def154bd3477ab45d23366be3680ebaec7e37fe2ac54af97
O₂(AsXe)H₃(DbFPo₃)Md₂
99%
Obfuscated PowerShell executes decoded malicious payload
6c5157e20c93de46124ecd70d21b96c5ff86234adbf31e41c82769cd43119123
O₂(AsCo₂)H₃(HfOs₄U)Md(Bi₂)
99%
Malware captures screen and clipboard data
36637ad6c4db081520b7811c5daf8fd63389c21f273884bceeb7aed1280ffdfc
O₂(AsXe)H₃(DbFPo₅)Md₂
100%
eval.invokeobfuscation.multi-layer
e50e30304991e20a97925e69fa1af9caa2e3974ff300582147c7a051d98cb922
H(Cm₃)Md(Pa)
86d84a154a0a8ce888c1702725f7c4ef10bae8df4a5c0a4fdd17c95a9cfd8c05
H(Cm₃)Md(Pa)
083f02e65413e379e6aaf2ce856f979abfdc38835205b9dd295df7eb320e0515
H₂(Cm₂F)
30324cbb14bea1ea2f63348fe1170177666c1989510130c3a765d0c860071698
K(Te)O₅(ErAlAsCCa)H₉(Cm₈Cr₆Db₉F₇Mg₃Os₁₅Po₁₀TiU)Md₆(Bi₇BkPaPtSi₂)
92%
injection.thread-hijacking
df8056bd298f4fd5bc18e419e525f4ee8bda52496b45806d6505ecc2c2ab7f99
K(Li₂)O₄(C₄EuAs₂Er₃)H₁₀(F₉Cm₁₅Cr₉Db₆DsMg₃Os₁₆Po₁₆Ti₂U₂)Md₆(Bi₈PaPt₂Si₂)Th
92%
staging.embeddedstealer.package
23dce97932f96517f4232f771be505d3ff885ba264dc27ddc23262fd31100e09
O(Er)H₅(DbF₄Os₅Po₈Ti)Md₂(Bi₇Pa)
92%
masquerade.trustsection.metrics
100%
XOR decryption and dynamic code execution
3ad4b34297520e16c1326483216d801892b3230761ef68fbed6483f3d4493cd3
O₃(As₂CEr)H(Os)Md₃(PtBiSi₃)
92%
obfuscator.garbleexecution.windows-loader
9d3eb0131e1f0c2bbb1b8dfb78c30a1d1c92982d0cee086e380a64ae1488f1d6
H(Cm₂)Md(Pa)
e2f9df115f51ef1c96f4b35cebb4fab0eded77340f88ac6e2c0872769a99be40
K(Li)O₆(CCaErCo₂ILa)H₁₁(Cm₁₁Cr₄Db₇DsF₁₁HfMg₂Os₈Po₉TiU₄)Md₄(Bi₅BkPaSi₂)
92%
infrastructure.ip-portbrowser.dpapi
f306f95f4a9b8b5f708e349465614c67ed2e60a13f2d28efefc7fc78c223e51e
O₂(CI)H₈(CmDbDsF₆MgOs₅Po₄U)Md₂(Bi₃Si₃)
92%
execution.installersystem.shutdown
214491310a1e9189a111954e90388be6f6b8fec87676e957e694328e56a038a8
O₃(As₂ErC)H₈(CmCrDb₄F₆HfMg₂Os₉Po₆)Md₄(Bi₆BkPaSi₂)Th
93%
Compromised AnyDesk certificate embedded
018cff3b8d3d9ecd0cdff35222c83d0859933652f5b368246a8641d96fa7154c
K(Mc)O₂(AsC)H₂(Db₄Po)Md₃(Bi₃BkPa)
92%
pack.runtimestaging.memory
0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1
O(C₂)H₈(Cm₁₂Cr₅Db₂F₄MgOs₄Po₆U)Md₄(Bi₄PaSi₂)
92%
staging.encryptedloader.native-reflect
dc6149638981cc66314286fc00c75a16e54aac19811425f5bf0ab56256115dc5
K₂(Am₂Li₃)O₉(SAs₄C₅Al₂DyErEu₂IPr₂)H₁₁(F₁₄Po₁₉Cm₂₄Cr₆Db₁₀Ds₂Hf₆Mg₂Os₂₆Ti₂U₅)Md₅(Bi₁₂Pa₃Si₂)
100%
hidden-payload.runtimeobfuscator.js-obfuscator
71462455b412c5ec1048dc1667d45c04282f45846fc51bc28f1aa5628e8827b7
K₂(Am₂Li₃)O₈(Al₃IAs₄C₃DyErEuPr₂)H₁₁(Cm₂₂Cr₇Db₁₀Ds₂F₁₁Hf₆Mg₂Os₂₇Po₁₇Ti₂U₅)Md₆(Bi₁₂Pa₃Si₂)
92%
debugger-detect.tlsdestroy.file-deletion
59e159baaba5a53144003115d39539efb7b72c96c7070eeb670830df6eae633c
K(Li₂)O₄(C₅EuAs₃Er₃)H₁₀(F₉Cm₁₆Cr₉Db₆DsMg₃Os₁₆Po₁₇Ti₂U₂)Md₆(Bi₇PaPt₂Si₂)Th
99%
PyInstaller stealer with obfuscated embedded payload
1d3d1f8966f2ea7415cf7231ad8f25fc74167710c1a87b3654da999513c3a994
O(Er)H₅(Db₃F₂MgOs₄Po₇)Md₂(Bi₄Pa₂)
85%
Go loader with direct syscalls
d922f7fc1790cc37aa590a76b0035e26d0680c53294ac57287d05f54e53c9f04
O₃(AsCEr)H(Os)Md₄(PtBiSi₃)
92%
obfuscator.garbleexecution.windows-loader
85%
Themida packed loader with evasion
5922d829e7b5787f08c7e031eecdf9fa2edf9fc988c09ad90ad5091612cd3109
K(Mc)O₂(PAs₂)H₈(Db₆Cm₅CrDsF₆HfOs₈Po₉)Md₂(Bi₅)Th
100%
WannaCry ransomware with embedded payloads
100%
Obfuscated PowerShell script
9c41611e704f413156caa104cc487b9f0a095768a4343898861de8d69d827abb
O₃(As₂CEr)H₂(OsPo)Md₃(PtBiSi₃)
98%
Go loader with shellcode injection
ec23759b198014bc56c771729f11223015c56e13d2bb3a4fa67ff80aad54db51
H₃(DbFU)
3fc2edb46b7b5bb430b2e63b7da48dcbef35a63884e219edac2960131062a651
O₃(CEr₂I)H₇(DbDsF₆MgOs₄Po₄U)Md₂(Bi₃Si₃)
92%
file.lureexecution.installer
1f30a807c047970be0b5cfcb0c2a7bc1958d7474ea4920ade5980b5942d3ddbb
✓
O₃(CIAs)H₄(F₆Os₄Po₄U)Md₅(Bi₂PaPtSi₃)
98%
NSIS dropper with opaque payload
4725a1883e2171c2e181e6fd45003acb59ca4e9cbe031fdd3b79ef0d697d36aa
O₆(LaAsCCoErP)H₁₀(Cm₁₅Cr₄Db₄DsF₁₂MgOs₁₂Po₁₄Ti₂U₂)Md₄(Bi₄PdSi₂)
delivery.gpo
d3fac1ce0cb15df1533397e0b5dd94003d3231e524552867e9cb3c7ed3cec690
H(Cm₂)Md(Pa)
71620d29d9c3a30975c21d0cd172faf3df28e0cb23a2307418740caff575b36c
H(Cm₃)Md(Pa)
8b457396f48d7b41ffdc08e9ac5a25109caf0db1ec8784115bd20d8f87892f20
H₇(Cm₇Cr₇Db₂F₄Os₇Po₆U)
69%
Legitimate OpenFaaS CLI tool
62fa24c9f3f0cb8f0ef411ecd4d0939e775bcbadc30ae8a0ac4e999dae049dbb
K(Mc)O(C)H(Cm)Md(Bi₃)
100%
Mydoom worm packed binary
602cc7985ad5a2a05425cfa1b16aa7a6e00165455a6d6566234141bc787ff8e9
K(Mc)H₆(Cm₄Db₂F₄Os₃Po₄Ti)Md₂(Bi₂)Th
100%
windows.generic_threatworm.mydoom
578d6beea6123baf73ce30fd1cb245fac0225fcd2199754e12597550ffafd40a
K(Li₂)O₄(C₄EuAs₂Er₃)H₁₀(F₉Cm₁₅Cr₉Db₆DsMg₃Os₁₆Po₁₆Ti₂U₂)Md₆(Bi₈PaPtSi₂)Th
92%
staging.embeddedstealer.package
02469c593ecd42b98fd30db086bfc49c9a486d123085a626cf2ab247d7003e65
O₂(CI)H₅(DbF₆Os₅Po₄U)Md₂(Bi₂Si₃)
98%
NSIS dropper with self-signed, opaque payload
73827e53552bac53092a3f937f4c29d060969093cf20d9548836de516f2efede
K(Mc)O₂(As₃C)H₂(Db₃Po)Md₃(Bi₂BkPa)Th
98%
Reflective payload loader with obfuscation
e130fb44008595cc59028b23ee7c616e3c927a8ccdc03b0972a690e0378b0265
O₂(CI)H₅(DbF₆Os₅Po₄U)Md₂(Bi₂Si₃)
98%
NSIS dropper with reboot and execution APIs
2ba624a7b1d00f954c594cb13b70f7e26424db2d8161591dac24ea3612c652d7
O₃(C₂Co₂Er)H₁₀(Cm₂Cr₂Db₄DsF₉HfMgOs₈Po₉U)Md₄(Bi₆BkPa₂Si₂)
57%
Legitimate Yamaha audio software installer
08b6a46efe441d7af0c4172146bb3239d8dea5b4659d7e6502fcb66bef217099
O₂(AsS)Md(Pa)
99%
Opaque payload and fabricated identity
56066a1f125a91776ea54cf20a0344731c1c9fc7ff822b9b64de6799d7cfb3e3
O₃(AsCDy)H₆(CrDb₂F₃HfOs₆Po₆)Md₅(Bi₅BkPaSi₂)
e58bd6b940888a2342490809a8b5091960c22cc94e05666e18ae20f5394ad0f6
H(Cm₄)Md(Pa)
879daa96ac18a98fe5d8c650f71aad182776f96d00209eabcd05450833c8cfa7
K(Li₂)O₄(C₃EuAs₂Er₃)H₁₀(F₉Cm₁₆Cr₉Db₆DsMg₃Os₁₆Po₁₆Ti₂U₂)Md₆(Bi₈PaPt₂Si₂)Th
92%
staging.embeddedstealer.package
b6fb41008cf004fa99f2b5617108f43a0e054d1f9343be43d44aaa50b0514da8
K₄(AmLi₂McTe₂)O₈(Al₂C₂CaAs₂CoEr₂PrXe)H₁₁(Cm₂₆Os₃₃Cr₃Db₁₄Ds₂F₁₈Hf₃Mg₃Po₂₇TiU₅)Md₈(ArBi₉Bk₃HePa₂Pt₂Si₅)
49%
Legitimate JetBrains profiling tool
0a2f2049efbacbadb96e24d1cea250758ec42b92b0870417a73b5e264220ea41
O₄(Er₂AsCDy)H₁₀(Cm₃CrDb₂DsF₅HfOs₈Po₆TiU₂)Md₃(Bi₄PaPt)
49%
Legitimate JRuby installer package
85993da1ad3d542eb448ea864aa0530860dea6c7788021d6d45f58eedff1b7e9
H(Cm₂)
1fb823307ff526b68b05b1b93e906d1b997090fd109c69374a9a32b582fb6812
O₇(Al₂CAs₂EuCo₃PS)H₁₀(Cm₁₆Cr₉Db₆DsF₁₂MgOs₈Po₁₂Ti₂U₂)Md₃(Bi₆Si₂)
92%
infrastructure.ip-portdebugger-detect.check