windows · Index

Karuzip.Karuzip 1d ago windows

c1bb68ca083682bd0d2615593b1ba972c49bb225317700713f5939a71568f623 K₃(LiMcTe)O₁₀(C₉Er₈As₁₆Al₃CoDy₄ILaP₃Pr)H₁₁(Cm₁₇Cr₃Db₁₄DsF₁₇Hf₄Mg₂Os₁₉Po₁₇Ti₂U₅)Md₆(Bi₂₂BkPaPt₂Si)

63% Legitimate archive installer

microsip-portable 3.22.16 2d ago windows

6132e3383b46826bf5914c2c06f80ea1ccc604d274413fadb13e96422ed18928 K₂(Li₅Mc₂)O₁₂(C₁₀Co₃As₁₄Al₂CaDy₂Er₆I₂LaP₂PrXe₂)H₁₁(Cm₁₇Cr₁₈Db₈DsF₁₈Hf₉MgOs₃₀Po₁₈TiU₉)Md₅(Bi₂₆PaPtSi₄)

65% Signed MicroSIP portable with standard media libs

lanxiuyun.Catrace 4d ago windows

8c547a44284a017c351092cf32913b8a6b8e5d520aafb10dc7f1ac91505873e2 K₄(AmLi₂McTe₂)O₁₂(Co₃AlAs₁₁C₈Ca₃Dy₂Er₄I₄P₂PrS₇Xe₂)H₁₁(Cm₅₁Cr₅Db₄₀DsF₂₇Hf₆Mg₂Os₂₇Po₄₄Ti₃U₁₂)Md₆(Bi₁₇Bk₂InPa₃Si)

80% New package, high entropy, EDR evasion

MyQueueLOL.MyQueue 5d ago windows

94738fb2994d66b812d5e1aeb4abaa346537555351c7c2c955bf10077f50d522 K₂(LiMc)O₈(AlAs₈C₄CaDyEr₅I₂S₂)H₁₀(Cm₂₆Cr₁₁Db₁₆DsF₅Hf₅MgOs₁₄Po₁₁U₆)Md₅(Bi₄BkPaPt)

48% RAT handler, input hooks, obfuscation

hellowind777.hellogrok Sep 17 windows

0ce7720c590e7de62b4909d5ae66a3d32c126033a92dbacb0e6adcca172b5573 O₆(As₄CDyErI₂P₂)H₈(Cm₁₁Cr₁₁Db₅F₅Hf₂MgOs₈Po₆)Md₂(Bi₃)

70% LLM app with crypto and process APIs

adamtheturtle.doccmd Sep 16 windows

0e0f378a6ca27059ec97e8262d7ec15af960e8b4521b4bd3604cc2cb3d6fef84 K₃(Li₁₂Mc₄Te₂)O₁₃(As₂₃Al₅C₁₀Ca₃Co₂Dy₃Er₁₀EuI₆La₂P₂PrS₅)H₁₁(Cm₄₉Cr₁₆Db₂₉DsF₃₀HfMg₈Os₂₄Po₃₀Ti₃U₁₁)Md₆(Bi₂₃BkPa₆Pt₅Si₄)Th

73% Unsigned PyInstaller, document-themed name

Microsoft.Sysinternals.ProcessExplorer Sep 15 windows

746770d3f54326dd7da16c2b2815803ab131f348cba24a91cb6a38cfd2f7073f K₂(McTe₃)O₁₀(Er₁₁As₈Pr₂AlC₅Ca₂Dy₄IP₈Xe₂)H₁₀(Po₂₂Cm₇Cr₂Db₄F₁₄Hf₃Mg₅Os₃₉TiU₅)Md₆(Bi₁₅BkPa₂Pt₂Si₄)

86% masquerade/trustprivilege-escalation/token-manipulation

laurentiu021.SysManager v1.103.0 Sep 15 windows

787c40cff07cdc25de3958b996e1093d056c8bf84216bd670364d6b2446ad121 K(Li)O₇(Al₂As₁₄C₂Dy₂Er₈P₂Pr)H₁₀(Cm₄Cr₂Db₈F₈HfMg₃Os₁₈Po₁₅TiU)Md₅(Bi₂₀PaPt₂Si₄)Th

78% Unsigned, embedded PE, VM checks

officecli Sep 14 windows

b1da1729b600f231358250f8f998be5f9ea881cb44b3d55d037c6a3e0250ccb9 K₂(Li₃Mc₃)O₁₁(I₂AlAs₁₅C₁₅CaCoDy₃Er₁₂P₃PrXe₂)H₁₀(Cm₂₉Cr₁₁Db₁₈F₁₅HfMg₂Os₂₄Po₂₅TiU₆)Md₉(Bi₁₇BkPa₂PdPt₄Si₄)Th

72% Unsigned, embedded PE, C2-like strings

zhukunpenglinyutong.CCGUI Sep 14 windows

53f1e5a509c1ab16abfe33cd97813832d91fed70575ac9678beeec8c9c7ccbb0 K(Li)O₅(CDyErIPr)H₁₁(Cm₁₄Cr₂Db₈DsF₁₇Hf₅Mg₂Os₁₅Po₁₃TiU₂)Md₃(Bi₁₀PaSi₄)

66% Unsigned installer, high entropy, AI key harvesting

AurelioAvila.PCTweaker Sep 14 windows

7bd85d0179f2647893f7cc552db17c53369c31d009f77dae798bbdbe636626e5 K(Li)O₃(CDy₂Pr)H₁₀(Cm₉CrDb₄F₁₅Hf₅Mg₂Os₁₅Po₁₃TiU₃)Md₄(Bi₉BkPaSi₄)Th

98% Signed, but heavy obfuscation and evasion

TIMi.TIMi Sep 14 windows

00e8146faef0e1cd80fa95214bba55b831cee0b3ef93ac18d407e022fb21e764 O₃(C₂DyI)H₆(CmDbF₉Os₆Po₃U)Md₅(Bi₇BkSi₃)

82% Signed PE modified post-signing

hrzlgnm.zux Sep 13 windows

74f173662e8cc7b59a5a1d9950b5e3019c78fbcebcb4db5665b9056cc23c078f K(Li)O₃(CDyPr)H₁₁(Cm₈CrDb₂DsF₁₃Hf₅MgOs₁₀Po₈TiU₂)Md₃(Bi₈PaSi₄)

80% Self-signed, high entropy, obfuscated

RyensX.OpenCodex Sep 13 windows

2a910aff1d359cec2bf16545ac0c593f24d134805bf60ec73c35e97754043593 K₂(Am₂Li₈)O₁₀(S₂Al₂AsCCaCoDyEr₂PPr)H₁₁(Cm₆₆Cr₁₁Db₂₆Ds₂F₃₅Hf₉Mg₅Os₄₁Po₄₂Ti₂U₁₆)Md₉(Bi₁₃BkInLiPa₁₁Pt₂Si₄)Th

80% High entropy, anti-analysis, obfuscation

NTKERNEL.WireSockVPNClientCLI Sep 13 windows

94c124b3418c8f5c7d3888087b22feeed2e9cc50ddc5c2462dc81ca7ccd2c976 K(Te)O₅(AsErCPPr)H₉(Cm₄Cr₃Db₂F₇Hf₂MgOs₁₉Po₅Ti)Md₄(Bi₈PaSi₃)

96% PE disguised as PHP file

railway v5.54.1-aarch64-pc-windows-msvc Sep 13 windows

6fcb1fec35c0c7c952e109926f08996dd78135fa1ca3026d2deec3f7e612eadf K(Li)O₄(CaDyErP)H₉(Cm₈Cr₆Db₆DsF₁₃Mg₂Os₁₀Po₈Ti₂)Md₄(Bi₂BkPt)

47% Credential theft and persistence

eac3to Sep 13 windows

c2e6e697a7e316edf166d0149f52c3af153fba59522e73180fad7907f06a7a9b O(As)H₃(Cm₅Db₃U)Th

81% Obfuscated JavaScript in archive

hapi Sep 12 windows

cb3973ac577e6f6e2fb894fb394ac2498e797bb1a60b1833bc493f6956ba02bc H₃(CmOs₆Po₂)Md

76% Embedded PE, debugger check

railway v5.54.0-aarch64-pc-windows-msvc Sep 12 windows

84cdfca02883b1bad5b4545b9681788f9073288ebb1c5540ea19374be74f39b9 K(Li)O₄(CaDyErP)H₉(Cm₈Cr₆Db₆DsF₁₃Mg₂Os₁₀Po₈Ti₂)Md₄(Bi₂BkPt)

47% Credential theft, persistence, evasion

CryptographicTriangles.TrianglesQt Sep 12 windows

e4d5325a99283ec7f963c314884d850ab1ffc8a0d9eaa5aea01bf30e7289ef62 O₃(AsC₂Dy)H₇(CmDbF₁₀HfOs₅Po₃U)Md₂(Bi₅Si)

74% Unsigned, high-entropy overlay, withheld indicators

ChrisLauinger77.QontrolPanel Sep 11 windows

15805d1bf634e34ff7afb78680d4a45e3a5271060b847e8b0967dd19c8702fd1 K(Te)O₄(AsCDy₂Pr)H₇(Cr₂Db₃F₂Mg₂Os₈Po₄U)Md₄(Bi₇PaPtSi)

83% Unsigned, high-entropy overlay, crypto refs

Lody.Lody Sep 11 windows

5db1b32113182d86029c601489d6680c8522a74e4a46ee81fb0c3f0ab233c166 O₃(AsC₂Dy)H₅(CmF₉Os₆Po₃U)Md₄(Bi₅PaSi)

52% Unsigned installer, high entropy overlay

Ardisk.Ardisk Sep 11 windows

20912a80bd785d2bc7a264d3db50b9c03666678e2d6ab2983fde1c527b98b7f7 K(Te)O₂(PPr)H₅(Cm₂F₅MgOs₁₀Po₃)Md₄(Bi₅Pa₂Si₄)

77% Unsigned installer, high-risk privileges

RigSmith.Rig 18.0_windows_arm64 Sep 11 windows

692eb1bd0ba2ca5dc7341cbadb7630753bbd946c962abf5f26bf50bad53ea00d K(Te)O₂(CDy)H₆(Cm₉Cr₉Db₃F₃Os₁₀Po₉)Md₄(BkPaSi₄)

51% Unsigned binary, process injection APIs

RigSmith.ClaudeRig 18.0_windows_arm64 Sep 11 windows

ea3b660a725845aaa8e25d2145dc8f7088e0d52af89a8a21e0fefbd7c35e2f9c K(Te)O₃(CaCoDy)H₆(Cm₈Cr₉Db₃F₈Os₈Po₁₁)Md₄(BkPaSi₄)

51% Unsigned binary, credential access

Sakana-yuyu.cursor-byok Sep 11 windows

101e36bebf5cccdf21c00849633aa507e4cb0c9e156fd74c46dbc467f03ab5b0 O₄(C₂DyErPr)H₁₀(Cm₁₀Cr₇Db₆DsF₁₀HfMgOs₁₄Po₈U)Md₅(Bi₉BkPaSi₄)

67% Unsigned installer, withheld C2 findings

RSGames.RSGames.Client Sep 10 windows

74507f1c2cb95485a3b23784278ef4041aaaacf11ad0c00f507e16653028d0c4 K(Te)O₂(DyPr)H₇(Cr₂Db₃F₃Mg₂Os₈Po₄U)Md₃(Bi₆PaSi)

56% Unsigned, high-entropy overlay, crypto refs

t8y2.DBX Sep 10 windows

9773b68e5e7f449f1f511332b8754c5711bfab86041d89be8857aedf31b6a8f4 K(Li₃)O₄(Co₂CDy₃Pr)H₁₀(Cm₁₈Cr₁₂Db₁₆F₁₈Hf₆Mg₃Os₁₆Po₁₅TiU₇)Md₅(Bi₈BkPa₂Si₄)

83% High entropy, anti-analysis, screenshot capture

ByteDance.Coze Sep 10 windows

f31f319ef151b88cce41b18b63f5e25d24902011e0ca0422184c3561b7273980 K₂(Am₅Li₄₄)O₁₃(Co₅Eu₃SAs₁₀C₇Ca₈Al₂Dy₆Er₄IP₃Pr₂Xe₂)H₁₂(Po₆₅BrCm₁₃₂Cr₂₇Db₆₁Ds₅F₅₅Hf₁₃Mg₅Os₇₁Ti₄U₂₂)Md₁₃(ArBi₁₈Bk₆HeInLi₅Pa₁₉Pt₄Si₆V)Th

66% Signed legitimate Coze installer

IObit.Uninstaller Sep 10 windows

a0a2494dc561955613c3e6b1e4a6d6e8f143ddb81927fe0c122e38fb4253529e K₃(Am₅Li₄Te₂)O₁₀(As₃C₃AlCaCo₂Dy₇Er₃I₃PPr₃)H₁₁(Cm₂₈Cr₁₄Db₉DsF₂₆Hf₄Mg₅Os₄₇Po₃₀TiU₅)Md₇(Bi₁₉BkHePaPt₂Si₄)Th₃

60% Vulnerable driver, process injection APIs

spicetify-cli 2.45.0-windows-x64 Sep 10 windows

eac783be8564b41fea953c43d87ec9fc925e419be46d708146fce1fedbe250f8 O₄(AsCErDy)H₉(Cm₃₃Cr₉Db₁₃F₂Hf₂Os₇Po₉Ti₂U₁₀)Md₆(BiBkPtSi₃)

80% indicator-removal/timestampstasking/timing

fnproject Sep 9 windows

c54a1215c96a016a119db65017b2583f1e5693524452b8bbd86ca44e6715eb92 K(Te)O₂(AsDy₂)H₆(Cm₁₁Cr₁₀Db₄F₂Os₇Po₄)Md₄(BiPt)

43% Unsigned Go binary, crypto, evasion

https://github.com/n-air-app/native-deps/releases/download/osn0.26.28/osn-0.26.28-release-win64.tar.gz Sep 9 windows

5c9767396cfd311a481394e53f6228b05ce4e31a03276a8a11f249f9e9b3e643 K₅(Am₃GaLi₁₁McTe)O₉(As₄Er₄Al₃C₂Ca₂Dy₄LaPrS)H₁₁(Po₂₈Cm₃₇Cr₁₃Db₁₁Ds₂F₂₈Hf₉Mg₅Os₄₀TiU₆)Md₅(Bi₁₂Pa₈Si₄)

80% control/signalpayload/section

migrate Sep 9 windows

bf68e2fdd1c8efd3cac59c6cb4cddca51546c402e3fc616172329d7686875ce8 O₅(AlCaDyErS)H₆(Cm₁₆Cr₉Db₁₃F₄Os₉Po₈)Md₅(Bi₂BkSi)

78% Unsigned, large, evasive API refs

Excelano.xftp 10.0_windows_amd64 Sep 9 windows

85d95b334c57b1a7f3d94feb1423ca9cd9b2438e62b87066cc8626f8eea32784 K(Am)O₄(AlDy₂ErS)H₆(Cm₁₁Cr₈Db₄F₃Os₅Po₄)Md₂(Si)

98% Unsigned binary, curl-pipe-shell docs

git-flow-next v2.1.0-windows-amd64 Sep 8 windows

9bfbc2746ea647fe664e0a5be375f7d7e144412d5031064f60efb1f8fbe1b656 O₃(CErS)H₅(CmDbFOsPo)Md₂(Si)

86% Unsigned Go binary, atypical path

MediaHuman.YouTubeDownloader Sep 8 windows

63a253ea805f2906f10825a6d8bd9a3d363904f91961d6d1173646a09cf8f3b9 K₃(Am₂Li₈Te)O₆(CaAlEr₄C₂Dy₅Pr)H₁₁(Cm₄₄Cr₁₅Db₁₀Ds₂F₂₂Hf₈Mg₅Os₃₃Po₂₉Ti₂U₅)Md₈(Bi₁₅InLiPaPt₂Si₄)

91% Browser cookie theft indicators

Bauerapps.RightNote Sep 6 windows

e050da398971e82e632edae58093e5559adf77f1a7048e4c3a8db565d29efa4b K₃(AmLiTe)O₆(As₆Co₃Dy₃Er₂LaPr)H₁₁(Cm₁₉Cr₄Db₂₃DsF₁₄Hf₅Mg₂Os₁₇Po₂₂Ti₂U₁₁)Md₈(Bi₁₃BkHePaPdPt₂Si₄)

99% Unsigned installer, high entropy, keylogging APIs

sonar Sep 6 windows

30d0fee209a65d62b63df5c163f88420bcac8ad1be03dd2e694feab384d9e21f O₂(CDy)H₇(Cm₁₀Cr₉Db₅DsF₃Os₈Po₆)Md₂(Bk)

72% Process injection and evasion APIs

RigSmith.ClaudeRig Sep 5 windows

85824be5d1bd967f3339581c11cb7aa66116162171b5dc071d9b04c6ad950214 K(Te)O₃(CaCoDy)H₆(Cm₈Cr₉Db₂F₈Os₈Po₁₁)Md₄(BkPaSi₄)

54% Credential access, process injection APIs

RigSmith.ChangeRig Sep 5 windows

4b518007b85b06aaa55861f32bf90a59a2d2984733612147467decc561c86e61 K(Te)O₃(DyErS)H₆(Cm₁₀Cr₉Db₂F₃Os₉Po₆)Md₄(BkPaSi₄)

60% Unsigned cert, credential access

railway Sep 5 windows

0e77b4877863956d8cb64a79f539dbb293640ef8820e5b550a19f022c4cfee5a K(Li)O₂(ErP)H₉(Cm₈Cr₆Db₃DsF₈Mg₂Os₇Po₇Ti)Md₄(Bi₂BkPt)

48% Autostart injection and hidden paths

Kindness-Kismet.Stelliberty Sep 5 windows

1c77061cb87da75c0df718156345badeccc1630d5dcdf1cfd29b89c7a0e9a2ff K(Te)O₂(Dy₂Pr)H₇(Cr₂Db₃F₃Mg₂Os₈Po₄U)Md₄(Bi₅PaPtSi)

70% Unsigned, high-entropy overlay, crypto refs

Lody.Lody Sep 5 windows

049991bf5744e3e2d5b1e5c66ec349acedaab6f80e2c9a400f3c4cfb3db418ef O₃(AsC₂Dy)H₅(Cm₂F₉Os₆Po₃U)Md₄(Bi₅PaSi)

72% Unsigned installer, obfuscated payload

faas-cli Sep 5 windows

835583959efdaf8ca73ea06d57ab0e6b5e0c31b2b9927e0ff2896940b76865a5 H₆(Cm₈Cr₁₀Db₃F₄Os₇Po₄)

62% Ransomware encryption indicators present

SnowdreamTech.unirtm Sep 4 windows

a38dbb10626e95f6c1cffdd56922a737338d4856fa5e23cc2a601f697ca6a7a0 K(Am)O₄(I₃CDyP)H₇(Cm₁₉Cr₁₂Db₁₃DsF₇Os₉Po₁₂)Md₄(BiBkSi)

85% Unsigned binary, remote download, crypto

HydraLauncher.Hydra Sep 4 windows

c21909eb2657570c225359a832769d302b16f5e9f2b37c199204f506c3f6c49d O₄(IErAsC)H₅(CmF₈Os₇Po₃U)Md₃(Bi₅Pa)

57% Unsigned, large NSIS installer

SFXTechInnovation.SimpleFixAI Sep 4 windows

6e13f715678944b97fed258c595d2a600f007e37307c97d279a91e2256c36192 K₃(McAm₃Li₅)O₁₃(C₄Ca₄Dy₆Er₈EuP₃Pr₂XeAl₂AsCoI₅S)H₁₁(Po₄₃Cm₄₀Cr₁₃Db₁₅DsF₄₂Hf₅Mg₇Os₄₂Ti₃U₇)Md₇(Bi₁₄Bk₃Li₂Pa₂PtSi₄)Th

97% High-risk system modification tools

ningbainb.DeepSeekHarnessDesktop Sep 4 windows

397037cd53abb654e438e61826d9219be8e33e606871e2458f17ec1a218c585a O₄(IErAsC)H₅(Cm₃F₈Os₅Po₃U)Md₃(Bi₅Pa)

59% Unsigned, embedded C2 endpoint

NoVirusThanks.OSArmor.Personal Sep 4 windows

5d333ecbee0cfea3b25e27a53e43620b12aae4ca65e78e40408a50fff6e2d650 K₂(Li₂Te₂)O₉(CoEr₃EuAlAs₆C₃Pr₂Dy₂P)H₁₁(Cm₂₂Cr₁₃Db₆DsF₂₀Hf₃Mg₄Os₃₀Po₂₃TiU₆)Md₈(Bi₁₆BkHePa₂PdPt₂Si₄)

65% Legitimate security software installer

SosomLab.NexaDir.Portable Sep 4 windows

53888c3fa0a1d6d61470746cb853935d1bfa0d7b16e897dc0b8dc425dc735940 H₉(Cm₄Db₃DsF₅Hf₂MgOs₅Po₄Ti₂)Md₃(Bi₃Pa)

62% Unsigned, embedded secrets, clipboard access

Microsoft.SurfaceApp Sep 3 windows

6a7f09c1f53fb62d8721c0f706c44d86a326f1c6ffed4dffccfbb093f8bfc95b K₃(Am₄Li₆Mc)O₆(Er₄As₂CCaDyPr)H₁₁(Cm₃₁F₁₉Cr₁₅Db₂₃DsHf₃Mg₄Os₃₆Po₂₇Ti₂U₆)Md₁₀(Bi₁₁Bk₂Li₂PaPdPtSi₄V)

100% Legitimate Microsoft Surface Hub app

k3sup Sep 3 windows

6a2d1c5f9e7529b0e6291bde7ff2d082304e8e51e8833902d44ee9037353c5e3 O(C)H₆(Cm₁₂Cr₁₀Db₄F₇Os₅Po₆)

61% Unsigned, withheld ransomware indicators

railway Sep 2 windows

12e9d14b65eb9c6b54c9e9939ea7166824610d3956d27d1cf762acc58a3c0ea1 K(Li)O₂(ErP)H₉(Cm₈Cr₆Db₃DsF₈Mg₂Os₇Po₇Ti)Md₄(Bi₂BkPt)

45% Shellcode persistence and credential theft

pulumi Sep 2 windows

6a09d846c9a23c602db36d19fd227307be5c77bd23f9536d87d92fc3ad344d32 K₂(LiTe)O₇(IAl₂AsC₄Dy₂ErS)H₈(Cm₁₈Cr₁₂Db₁₅DsF₉Os₁₆Po₁₆Ti)Md₅(Bi₆Bk₂PtSi)Th₄

60% Legitimate Pulumi infrastructure tool

ghost-him.ZeroLaunch-rs Sep 2 windows

64ba4c0e5f13adcb8859873331ca2db9af12f2b72b637d8e568b2535b98c7d60 K(Te)O(S)H₂(Os₃Po)Md₄(Bi₅Pa₂Si₃)

71% Hidden PowerShell download in installer

Relic.Relic Sep 2 windows

fdcfff68c49de5ca94776393169cd0f1737bd1c594e62d56ad2eb21f222942e4 K(Te)O₃(DyErPr)H₇(Cr₂Db₄F₂Mg₂Os₈Po₄U)Md₂(Bi₆Pa)

77% Inconsistent Inno Setup loader

HoraceMaxwell.Horosa Sep 2 windows

b1a261f0bf60f4d8630c6b4f65e27f3c23eb76867152b4598e0f54ee97c040b3 O₄(IErAsC)H₅(CmF₈Os₆Po₄U)Md₃(Bi₅Pa)Th

72% Unsigned, encrypted NSIS installer

Cindy.Cindy Sep 2 windows

8e01972e14a0f78b09d04d2a9eeb76ccc9a20d9d177d7e5c18ccd0d4f803c219 K₄(Am₈Li₄₆LuTe₄)O₁₃(C₆Er₁₀Al₂As₉Ca₃CoDy₂I₂La₂PPrS₃Xe₃)H₁₁(Cm₁₃₀Cr₂₃Db₆₁Ds₄F₅₆Hf₁₃Mg₄Os₆₅Po₉₀Ti₃U₂₁)Md₁₁(Bi₁₄Bk₅InLiPa₂₆Pt₄Si₆V)Th

97% AI agent credential access

GaoyangZhang.RivonClaw Sep 2 windows

c9bc01fba08b9c8a40b428cb43dc20cfa4f62cac2995773cc0671871c317f3f8 O₂(CDy)H₅(Cm₂F₉Os₇Po₃U)Md₅(Bi₅PaPtSi)

66% Unsigned large NSIS installer

MaxValueSoftware.PokerTracker4 Sep 1 windows

e8697603080442092803137245158ca2138519be47fb25feef80f62109d4bbbd K(Te)O₃(ErDy₂Pr)H₇(Cr₂Db₂F₃Mg₂Os₈Po₄U)Md₃(Bi₆PaSi₄)

95% PE disguised as PHP file

Bluebeam.Revu.21 Sep 1 windows

1e2502e1df59c84486ac217737836e246988fcc944a8f7032f0a16d7faefded2 K(Te)O₆(Al₂AsEr₃SDy₂Xe)H₁₁(Cm₉Cr₃Db₆DsF₁₄Hf₂MgOs₂₃Po₁₅TiU₃)Md₈(Bi₁₁Bk₂Pa₂PdPtSi₃)

97% Legitimate Bluebeam Revu installer

cliamp Sep 1 windows

14980d71183a3bfa7931e12be9977754451a2a5c209d9639755bfed277e1d819 O₃(XeAsCa₂)H₇(Cm₂₂Cr₁₁Db₅F₂MgOs₇U)Md₄(Bi₃Pt)

55% Ransomware encryption indicators present

sysinternals Sep 1 windows

ec1c22581518e5a8661ec26886bc2eaefe9e59cf2ad7fba41926c19d356de169 K₄(Te₂AmLi₂Mc₂)O₁₂(C₃Al₂As₅CaEr₈ILa₂P₄Pr₂CoDy₅Xe₂)H₁₁(Po₃₉Cm₁₉Cr₂Db₁₃DsF₂₈Hf₇Mg₈Os₅₆Ti₃U₉)Md₇(Bi₁₀Bk₂HePaPt₂Si₄)Th₅

64% Legitimate Sysinternals suite

laurentiu021.SysManager Sep 1 windows

052ef3e69de8b1a90a57341832533c46221e675977db1259de28546b6273e0db K(Li)O₅(Er₃AlAsDyPr)H₈(Cm₃Db₆F₅HfMg₃Os₁₄Po₁₂U)Md₅(Bi₁₁Pa₂Si₄)Th

99% Unsigned, obfuscated, AMSI evasion

PCSX2Team.PCSX2 Sep 1 windows

e0995ffa2bb8eee8ac0df55e487ab1b9954c269a414a189cd7830fbc776e2725 K(Te)O₃(Dy₂ErPr)H₇(Cr₂Db₃F₃Mg₂Os₈Po₄U)Md₃(Bi₆PaSi)

60% Unsigned, checksum mismatch, high entropy

Proma.Proma Sep 1 windows

ca6c26b38218be4948767c1ef0e8442ded35b1e32bf1c2d3fa3ec41b7021c2c6 O₄(IErAsC)H₅(CmF₈Os₆Po₃U)Md₃(Bi₅Pa)

58% Unsigned, encrypted NSIS installer

Filedini.Filedini Sep 1 windows

efb53166be1c79b5a0f3648291f7568b4249e5bb1d53445c1ce20b37539f23c9 K(Te)O₃(Dy₂ErPr)H₇(Cr₂Db₂F₂Mg₂Os₈Po₄U)Md₃(Bi₅PaSi)

58% Unsigned, malformed Inno installer

marcinz606.NegPy Sep 1 windows

3a78afd019a57fc2970724e361644c417e4202ab0cc435d1453f5b99e30ae3b6 O₄(CIErAs)H₅(CmF₈Os₆Po₃U)Md₄(Bi₅Bk)

66% Standard NSIS installer

AQBot.AQBot Sep 1 windows

4da198a906974c9c99f39a7171796276eb41037bc3ad9065bc91b18fb1c933ab K(Li)O(Pr)H₁₁(Cm₁₀Cr₈Db₅DsF₁₇Hf₅MgOs₁₅Po₁₂TiU₃)Md₅(Bi₈PaPtSi₂)

56% AI agent with dangerous command execution

postgresql Sep 1 windows

59f8ce701c63c2ed623c665a5e51b3ef6f2e37ccf837b68ffeed0742d0ae6abd K₄(Am₁₁Li₅₄LuTe₃)O₁₄(S₁₀C₅Ca₁₁Er₁₀Al₄As₇Co₃Dy₃Eu₂I₃La₂P₂PrXe₈)H₁₁(Hf₁₃Po₇₅Cm₁₆₇Cr₂₈Db₇₈Ds₃F₅₉Mg₈Os₈₉Ti₆U₂₀)Md₁₂(Bi₁₅Bk₁₁HeInLi₃Pa₃₆Pt₅Si₄V)

86% app/agent-skill-scannercapture/network

halo Sep 1 windows

7a1d6ea0800e8940672aab99a7328b7bd9520e297677169594328004a41991bc K₂(AmLi₃₅)O₆(CAs₇CoErLaXe₃)H₁₁(Cm₆₃Cr₁₇Db₄₉Ds₂F₂₀Hf₄MgOs₁₉Po₂₆Ti₃U₁₇)Md₈(Bi₄Bk₄He₂Pa₁₁Pt₂Si₃)Th

64% Legitimate Halo CMS application

tinygo Sep 1 windows

2698c3ade60d536bec71c8bb645350e264000ef59e62223588ba822b51187fc1 K₃(AmLi₂Mc₂)O₁₁(As₄Er₈LaPCCaDy₃IPr₂S₂Xe)H₁₁(Db₂₆Cm₆₇Cr₁₀Ds₄F₃₃Hf₅Mg₆Os₅₉Po₃₉Ti₂U₆)Md₁₀(Bi₄Bk₃HePa₂Pt₃SiV)

80% kernel-hide/controllkm/interface

AntoineAflalo.SoundSwitch Sep 1 windows

0eca6cf909adf9746cba4b60657b0b4533184e4ccafb17284a77215f7a5ab48d K₂(McTe)H₇(Cr₂Db₃F₂Mg₂Os₆Po₄U)Md₄(Bi₇PaSi₂)

93% XMRig string in installer

Feci.ParleyDeckCli Sep 1 windows

12b64df961a0f5f702d11619d095452da0d53939f0480f9993ac97231e7acba6 H₅(Cr₂DbF₂Os₄Po₅)

61% Unsigned Go binary with recon and evasion indicators

SosomLab.NexaMemKeeper Aug 31 windows

b14b69822c78bd24d5af9a97f9903e849bcd4eccc95425b4977ccea55747e6e7 K(Te)O(Er)H₇(Cr₂Db₃F₂Mg₂Os₆Po₄U)Md₂(Bi₆Pa)

92% Tampered Inno loader, unsigned, evasive

d4vid87.hookecho Aug 31 windows

97e29b3b5aa47135b1c0c6d87a680e668aa90eda8f09b2c0df716e81e98061f2 K(Te)O(Er)H₇(Cr₂Db₃F₂Mg₂Os₆Po₄U)Md₂(Bi₆Pa)

86% Unsigned, high-entropy overlay, crypto refs

Psyche.Kelivo Aug 31 windows

99599ed8849e261eb2b492c5ca778a14275e0aab22d376ded96d292fde0c47eb K(Te)O₂(DyEr)H₇(Cr₂Db₃F₂Mg₂Os₆Po₄U)Md₄(Bi₅PaPtSi)

76% Unsigned, high-entropy overlay, crypto refs

zeebe Aug 31 windows

76c5d9380906b599e8e7105a38e6e7141537c5546d69a3de6dd1da6970dd2a23 K₂(Am₂Li₄₉)O₇(Eu₂Al₂As₃C₃CaDyXe₂)H₁₁(Cm₆₇Cr₁₅Db₅₀Ds₂F₂₈Hf₄Mg₃Os₂₆Po₃₄Ti₃U₁₅)Md₁₁(ArBi₁₀Bk₃HeLiPa₄Pt₂Si₃V)Th

66% legitimate Camunda Zeebe distribution

ZMGID.Kivio Aug 31 windows

24f41d6fe89aa5b93c952309b72edae704779cc145261516236d927d50c7f356 K₂(AmLi)O₆(I₂Co₂C₂Dy₂PrXe)H₁₁(F₂₆Cm₂₂Cr₅Db₁₃DsHf₅MgOs₁₄Po₁₈TiU₅)Md₅(Bi₇BkPa₂Si)

100% Embedded destructive shell commands

Filedini.Filedini Aug 31 windows

02e86cb4890ef7c023501d9539216266abf03d8a9c19de0b7b47508d788b406c K(Te)O₃(Dy₂ErPr)H₇(Cr₂Db₂F₃Mg₂Os₈Po₄U)Md₃(Bi₅PaSi)

58% Unsigned, corrupted Inno installer

hrzlgnm.zux Aug 31 windows

886a364ceff7b2fcc848d3cbb21af7911a22b510d75c011d8cffef63a68663b4 O₂(CI)H₅(CmF₈Os₅Po₃U)Md₃(Bi₄PaSi₃)

98% Self-signed unknown NSIS installer, standard behavior

RyanYuuki.AnymeX Aug 31 windows

c1780331d3614177b92286563b6788ef90ff566b3ba3a8ddf116ba73ea5611e7 K(Te)O₃(DyErPr)H₇(Cr₂Db₃F₂Mg₂Os₈Po₄U)Md₄(Bi₅PaPtSi)

59% Unsigned, checksum mismatch, high entropy

Netpack.XFB Aug 31 windows

ab34cbc6f2b2f431860565ad77fcc7c48c338742d4a260a9426cfa836e77bfb5 O₄(C₂IAsDy)H₅(CmF₁₀Os₆Po₃U)Md₄(Bi₅BkPaSi)

91% Unsigned, encrypted NSIS installer

Flowscripter.example-host-application Aug 31 windows

b186834b0db80179ba2662eef5476acdc6231244a6627b9b50cf503312efc2cd K(Li₂)O(Er)H₁₁(Cm₃₂Cr₇Db₆DsF₁₈HfMg₂Os₂₀Po₂₀Ti₂U₃)Md₆(Bi₅BkPaPt)

78% Embedded PE, CDP, schtasks SYSTEM

ASGARDEXMaintainers.ASGARDEX Aug 30 windows

561d11c1a191a167fcc66030e60a3b260620854ba9c371dfd5e5250e4c3e6031 O₃(ErAsC)H₅(CmF₈Os₆Po₃U)Md₃(Bi₅Pa)

56% Unsigned, high-entropy overlay

SFXTechInnovation.SimpleFixAI Aug 30 windows

7edb72087e984d903b57dee7a0dca93b0a084997b20bd62f36a51f58a6953f01 O₄(AsC₂DyEr)H₅(CmF₁₀Os₅Po₃U)Md₃(Bi₅PaSi)

59% Unsigned installer with high entropy overlay

relic-setup 1.0.41 Aug 30 windows

d3af7b2d6ef56d04ef89a34652a1938dcb4ef0dacef31043d133e7ee31310af0 K(Te)O₃(DyErPr)H₇(Cr₂Db₃F₂Mg₂Os₈Po₄U)Md₂(Bi₆Pa)

77% Inconsistent Inno Setup loader

AQBot.AQBot Aug 30 windows

ecf7e84a04afb4ed73b7237b366f03f263571d7e7a2592e365650874a240a3ca K(Li)O₂(CPr)H₁₁(Cm₁₀Cr₈Db₅DsF₁₈Hf₅MgOs₁₅Po₁₂TiU₃)Md₅(Bi₈PaPtSi₂)

69% AI agent with dangerous command execution

Nexmoe.VidBee Aug 30 windows

db7f03d0a37bd0538b7cd802ad0b010828a2e222c7bfc75df0aefeaf1548818c O₄(IAsC₂Dy)H₅(CmF₁₀Os₇Po₃U)Md₄(Bi₅PaSi)

53% Unsigned, encrypted NSIS installer

Kindness-Kismet.Stelliberty Aug 30 windows

9f1db7df22159477e96ed49b928dc0f563ebe21e85a1774c4ffb09c3430ca3be K(Te)O₂(Dy₂Pr)H₇(Cr₂Db₃F₃Mg₂Os₈Po₄U)Md₄(Bi₅PaPtSi)

52% Unsigned, corrupted Inno Setup loader

AQBot.AQBot Aug 30 windows

e1b52dfa1559a5ee81563de306405fc2b8262df3f613c85cc04350f05c0ab144 O₃(IAsC₂)H₅(CmF₁₀Os₅Po₃U)Md₃(Bi₅PaSi)

67% Unsigned, encrypted NSIS installer

VWSPython.vumark Aug 30 windows

d12d5cc9c90c0a471dd091b00e182f9848c97d7efa71032de5e530d6a780d12a K₂(AmLi₄)O₅(AlDy₂Er₄PrS)H₁₀(Cm₂₈Cr₁₅Db₇DsF₂₂Mg₇Os₁₈Po₁₉Ti₂U₂)Md₆(Bi₉BkLiPaSi₄)Th

82% Unsigned PyInstaller with evasion markers

Mega.MEGASync Aug 30 windows

30be55080b039d5ffa957dd4c02b3282bfb62f7718c0b3d216c6e54129e665fa K₃(Am₃Li₅Lu)O₆(SCErI₂AlAs)H₁₁(Cm₃₀Cr₁₆Db₈Ds₂F₂₂Hf₅Mg₅Os₂₉Po₂₆Ti₂U₆)Md₆(Bi₁₇Li₂PaPtSi₂)

94% Legitimate MEGAsync installer

rajsriv.WINbar Aug 30 windows

771cae993a5ba5279445e5e6e1cee68e584093cb7c2ba97a98bd7e3ae9dfbed0 K₂(Am₃Li₆)O₉(CoAl₂AsCaDy₃Er₃I₂PrS)H₁₁(Po₂₈Cm₃₀Cr₁₆Db₁₂Ds₃F₂₆Hf₇Mg₈Os₃₁Ti₂U₆)Md₇(Bi₁₁BkLi₂Pa₂PtSi₄)Th

97% Unsigned PyInstaller with evasive findings

AurelioAvila.PCTweaker Aug 29 windows

3cece7ea6a98955392b4791a75e0bb37321325f003bb83fcff6991d3f2d4e3a9 O₃(AsC₂Dy)H₅(CmF₉Os₅Po₃U)Md₃(Bi₅PaSi)

63% Unsigned, high-entropy overlay, many imports

AQBot.AQBot Aug 29 windows

0abbd81498abb6bf076584b6c7a72cf66554447fd87ae2334f0a821f5abbad46 K(Li)O₂(CPr)H₁₁(Cm₁₀Cr₈Db₅DsF₁₈Hf₅MgOs₁₆Po₁₂TiU₃)Md₅(Bi₈PaPtSi₂)

56% AI agent with dangerous command execution

Xieweikang123.ReFast Aug 29 windows

76ede5d2d59687ae4a0e9335b529bea3d0a2f35480ebd27b499c2347e4d53f67 K(Te)O(S)H₂(Os₃Po)Md₄(Bi₅Pa₂Si₂)

72% Hidden PowerShell download in installer

timokoessler.2FAGuard Aug 29 windows

77fa8ba2657613c3afdd9d7dc77b3d80966daddcf9a0331ce946449b05cb07ad K(Te)O₂(Dy₂Pr)H₇(Cr₂DbF₂Mg₂Os₈Po₄U)Md₃(Bi₇PaSi₃)

70% Inno loader checksum mismatch

ScytheLabs.Reaper Aug 29 windows

a3bd588a481eef22b943014e99f82312b9cdb1900b8aaccd301badf885c06101 K(Te)O(Er)H₇(Cr₂Db₃F₂Mg₂Os₇Po₄U)Md₂(Bi₆Pa)

74% Unsigned, checksum mismatch, high entropy